General
- Target IMG SHIPPING DOCS 24223_PDF.exe
- Size 425KB
- Sample200625-bjqrf4w8wj
- SHA256 203094520d66c8d9f2e8206f09b90ead4c30dfe3fb3da274075fd00651d63de8
- MD5 4a13e4535fb2b59386f867e9655c9173
- SHA1 d069643020dc029a453a068e796bc2cdb7c194e7
- SHA512 3675ac383314d6320ddef2baad02701a68033a719e90ce9696aa1a29143a74a1bfe584c42866119d5c89e7543407831f0d49de274c03f532cb01be839d1ba805
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
IMG SHIPPING DOCS 24223_PDF.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
IMG SHIPPING DOCS 24223_PDF.exe
Resource
win10
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.candenizcilik.com
-
Port
587
-
Username
-
Password
519025
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.candenizcilik.com
-
Port
587
-
Username
-
Password
519025
Targets
-
- Target IMG SHIPPING DOCS 24223_PDF.exe
- Size 425KB
- SHA256 203094520d66c8d9f2e8206f09b90ead4c30dfe3fb3da274075fd00651d63de8
- MD5 4a13e4535fb2b59386f867e9655c9173
- SHA1 d069643020dc029a453a068e796bc2cdb7c194e7
- SHA512 3675ac383314d6320ddef2baad02701a68033a719e90ce9696aa1a29143a74a1bfe584c42866119d5c89e7543407831f0d49de274c03f532cb01be839d1ba805
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext