General
- Target Document.pdf.exe
- Size 1.8MB
- Sample201109-7rlkk83qja
- SHA256 8fdc81efa6fd138b9f7dd2e95e957c5ffd1e1d31ed2d588b531433f4915f8ed2
- MD5 c3d24f1e6b0a84331cc31552ce197ab7
- SHA1 c674e7539ad0c7731f990ff0783bd8ca2987a729
- SHA512 fcac4164e6d93f55238bdd88063eb18893b3255d7c13f694c89c07f9ba933b7c48bd02e8edb7bc02b78d3e0b89d729bab731f46a876d4bfcc290d41eadc8d177
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Document.pdf.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Document.pdf.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
stanbest123
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
stanbest123
Targets
-
- Target Document.pdf.exe
- Size 1.8MB
- SHA256 8fdc81efa6fd138b9f7dd2e95e957c5ffd1e1d31ed2d588b531433f4915f8ed2
- MD5 c3d24f1e6b0a84331cc31552ce197ab7
- SHA1 c674e7539ad0c7731f990ff0783bd8ca2987a729
- SHA512 fcac4164e6d93f55238bdd88063eb18893b3255d7c13f694c89c07f9ba933b7c48bd02e8edb7bc02b78d3e0b89d729bab731f46a876d4bfcc290d41eadc8d177
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext