General
- Target Documents.pdf.exe
- Size 2.0MB
- Sample201109-a5tgrrwagj
- SHA256 37031fea4874b1ddcde5368e30c91c03b1f63c476fe1efd425a3fbc1f82f69e4
- MD5 a123d00baf25f3d70fe82b2fb2ca5a60
- SHA1 fbf8474eaf6c6609b5b4d300aa84184e28efa172
- SHA512 65315c8c0a46fd30d658490c9e2320648b238884f432ad524ad90f1669faef1ebbfc6fa2e451e6e64f3223ba2eb1af9e12c03093bd2d7c1eb6a8a5b265982e3a
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Documents.pdf.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Documents.pdf.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
stanbest123
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
stanbest123
Targets
-
- Target Documents.pdf.exe
- Size 2.0MB
- SHA256 37031fea4874b1ddcde5368e30c91c03b1f63c476fe1efd425a3fbc1f82f69e4
- MD5 a123d00baf25f3d70fe82b2fb2ca5a60
- SHA1 fbf8474eaf6c6609b5b4d300aa84184e28efa172
- SHA512 65315c8c0a46fd30d658490c9e2320648b238884f432ad524ad90f1669faef1ebbfc6fa2e451e6e64f3223ba2eb1af9e12c03093bd2d7c1eb6a8a5b265982e3a
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext