General
- Target RFQ PDSK20204247.exe
- Size 572KB
- Sample200728-8gkrpb7y66
- SHA256 be90335c4096906dba92f3f53fa540505ebcd8b1d08ff16ad89542cf2e170d4e
- MD5 6aeed3653a5f0b56b023a9ff43c2430b
- SHA1 88cd9c12c393a052a25cc15fcc328e5cb2ffb7b7
- SHA512 18b1a62a9e96484a4b4de4d074d69a036aab31108cabb72197caeeb8b86cfb6a9ceba26b03989f7171f9e0e85a696a25125cfaf6aab19a4fd5832af290838aa3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
RFQ PDSK20204247.exe
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ PDSK20204247.exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
challenge12345@
Targets
-
- Target RFQ PDSK20204247.exe
- Size 572KB
- SHA256 be90335c4096906dba92f3f53fa540505ebcd8b1d08ff16ad89542cf2e170d4e
- MD5 6aeed3653a5f0b56b023a9ff43c2430b
- SHA1 88cd9c12c393a052a25cc15fcc328e5cb2ffb7b7
- SHA512 18b1a62a9e96484a4b4de4d074d69a036aab31108cabb72197caeeb8b86cfb6a9ceba26b03989f7171f9e0e85a696a25125cfaf6aab19a4fd5832af290838aa3
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext