General
- Target RFQ#(10098764).pdf.exe
- Size 439KB
- Sample200723-sebnl8e6yn
- SHA256 e1600d5f0faed67689243cf28c68e6d34edeaa62693da3ca7028d252ef3207bb
- MD5 3ad879c6f4f99d6d65d51b1dbce8d5c7
- SHA1 bcd820ca4318964510392e5ce3e47b0be7120c2f
- SHA512 c5eb4808d5d54e5a9285fa256ae42876958df5980b0d135e03bb0c665275b5f4ff2578281d40cdb5c634c42aed8efc0c5ecf0b8ae4ed06ed5779a92d37248630
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
RFQ#(10098764).pdf.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ#(10098764).pdf.exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
sOeKk#E6
Targets
-
- Target RFQ#(10098764).pdf.exe
- Size 439KB
- SHA256 e1600d5f0faed67689243cf28c68e6d34edeaa62693da3ca7028d252ef3207bb
- MD5 3ad879c6f4f99d6d65d51b1dbce8d5c7
- SHA1 bcd820ca4318964510392e5ce3e47b0be7120c2f
- SHA512 c5eb4808d5d54e5a9285fa256ae42876958df5980b0d135e03bb0c665275b5f4ff2578281d40cdb5c634c42aed8efc0c5ecf0b8ae4ed06ed5779a92d37248630
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext