General
- Target DHL commercial invoice.exe
- Size 819KB
- Sample220131-e4vkjaehgr
- SHA256 3cd5be20fc52a85f70dae0f6ecb7a63e343a8eb1625ea53be792b497e5452251
- MD5 2ff7e7f69f13a4beb676f766ada4703a
- SHA1 b957fcecc135b1a4da6c97919ef7daf7a89e58a1
- SHA512 07c51cff8d34d957f8e6affcfebae9bd8590ccd81a960359e50d841fe6ac426d45129c2bc7cc224211e9b787337b40ac809dbd8b26c02e58b9ec8e569762a1f7
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
DHL commercial invoice.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL commercial invoice.exe
Resource
win10-en-20211208
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
graceofgod@amen
Targets
-
- Target DHL commercial invoice.exe
- Size 819KB
- SHA256 3cd5be20fc52a85f70dae0f6ecb7a63e343a8eb1625ea53be792b497e5452251
- MD5 2ff7e7f69f13a4beb676f766ada4703a
- SHA1 b957fcecc135b1a4da6c97919ef7daf7a89e58a1
- SHA512 07c51cff8d34d957f8e6affcfebae9bd8590ccd81a960359e50d841fe6ac426d45129c2bc7cc224211e9b787337b40ac809dbd8b26c02e58b9ec8e569762a1f7
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext