General
-
Target
PO#6275473 pdf.exe
-
Size
880KB
-
Sample
210511-qjnxgsfjq2
-
MD5
02d84808b070f7232a96a2dfbdf77be9
-
SHA1
35f15873b331fbd261c3ff3a39388616d99a1782
-
SHA256
6f88a4bdf6ca9a0b63e8dca6b56c2431acaccb7b58a6ddf5166028756c172d5a
-
SHA512
761945b6c916f5914204208a9df32c08620e588c568015c594e3b9aca61851df78f56769c56609685855e760254edd9f1e15bf4f0b346cb472ff2e8319b5f771
Static task
static1
Behavioral task
behavioral1
Sample
PO#6275473 pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PO#6275473 pdf.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.esquiresweaters.com - Port:
587 - Username:
[email protected] - Password:
Esquire@#2078
Targets
-
-
Target
PO#6275473 pdf.exe
-
Size
880KB
-
MD5
02d84808b070f7232a96a2dfbdf77be9
-
SHA1
35f15873b331fbd261c3ff3a39388616d99a1782
-
SHA256
6f88a4bdf6ca9a0b63e8dca6b56c2431acaccb7b58a6ddf5166028756c172d5a
-
SHA512
761945b6c916f5914204208a9df32c08620e588c568015c594e3b9aca61851df78f56769c56609685855e760254edd9f1e15bf4f0b346cb472ff2e8319b5f771
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-