General
-
Target
JQ2341024749.pdf.exe
-
Size
545KB
-
Sample
200716-3sfkr4n61s
-
MD5
32e8a4dfef3ba9272759b8cc19e0428b
-
SHA1
6c2fa10d8f4f68c8cc440e31b1625acf783973ce
-
SHA256
6c10ad5e7c9768684b4c869b3d6d974e07245af487170866b38bb2a5f4a756c6
-
SHA512
4f20df5f058e1987e0cc81c6724c215e8af4a2a67c47a2e4e21691ea2b0f992cfa401d5e3aba1cad0d89ee91788780223330ee0120b7e4798a3c69c7abae3e52
Static task
static1
Behavioral task
behavioral1
Sample
JQ2341024749.pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
JQ2341024749.pdf.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
sOeKk#E6
Targets
-
-
Target
JQ2341024749.pdf.exe
-
Size
545KB
-
MD5
32e8a4dfef3ba9272759b8cc19e0428b
-
SHA1
6c2fa10d8f4f68c8cc440e31b1625acf783973ce
-
SHA256
6c10ad5e7c9768684b4c869b3d6d974e07245af487170866b38bb2a5f4a756c6
-
SHA512
4f20df5f058e1987e0cc81c6724c215e8af4a2a67c47a2e4e21691ea2b0f992cfa401d5e3aba1cad0d89ee91788780223330ee0120b7e4798a3c69c7abae3e52
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-