General
-
Target
INQUIRY_pdf__.exe
-
Size
525KB
-
Sample
200707-3knc1fsp6x
-
MD5
15e91b66fb88390b9833cf3a79cab0ca
-
SHA1
e370b599b7e53bf35890e2e2f7e7b1a7e978ce86
-
SHA256
da7f00e9042a254deafda735ffb54a8c03b4d3af45bc297d1dd412f7840cb77f
-
SHA512
d5e5e63c7897506d80608ffff0571897b899d3964e19c51f8762412d04201a67b72a179bc11e6afb3c940a241dd42505ea9e074a947055b27aa6a4bd3704553e
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY_pdf__.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
INQUIRY_pdf__.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.jpmvt.com - Port:
587 - Username:
[email protected] - Password:
P@ssw0rd
Extracted
Protocol: smtp- Host:
mail.jpmvt.com - Port:
587 - Username:
[email protected] - Password:
P@ssw0rd
Targets
-
-
Target
INQUIRY_pdf__.exe
-
Size
525KB
-
MD5
15e91b66fb88390b9833cf3a79cab0ca
-
SHA1
e370b599b7e53bf35890e2e2f7e7b1a7e978ce86
-
SHA256
da7f00e9042a254deafda735ffb54a8c03b4d3af45bc297d1dd412f7840cb77f
-
SHA512
d5e5e63c7897506d80608ffff0571897b899d3964e19c51f8762412d04201a67b72a179bc11e6afb3c940a241dd42505ea9e074a947055b27aa6a4bd3704553e
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-