General
-
Target
New PO 3112021 pdf.exe
-
Size
1.1MB
-
Sample
210721-lach8arpnx
-
MD5
9b1e8cf1b62804c4fdf40c97d4680c5b
-
SHA1
7ab69368a60fc7c0ab2895435b78a68044c05456
-
SHA256
04bc957b4a8ec5780077baf2e8960cddfcef204cad9eebee56efbc647658da7e
-
SHA512
d3d4f448a301a61b3977f2984a2ed084b4996acd9f51662c3eaef859c2096b6defbc644321fd783bf50fc30c15ffeb72fc24c92283fcc9116122ecafc5b59d25
Static task
static1
Behavioral task
behavioral1
Sample
New PO 3112021 pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
New PO 3112021 pdf.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.esquiresweaters.com - Port:
587 - Username:
[email protected] - Password:
Esquire@#2078
Targets
-
-
Target
New PO 3112021 pdf.exe
-
Size
1.1MB
-
MD5
9b1e8cf1b62804c4fdf40c97d4680c5b
-
SHA1
7ab69368a60fc7c0ab2895435b78a68044c05456
-
SHA256
04bc957b4a8ec5780077baf2e8960cddfcef204cad9eebee56efbc647658da7e
-
SHA512
d3d4f448a301a61b3977f2984a2ed084b4996acd9f51662c3eaef859c2096b6defbc644321fd783bf50fc30c15ffeb72fc24c92283fcc9116122ecafc5b59d25
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-