General
-
Target
MPU702734-pdf.gz
-
Size
14KB
-
Sample
210722-8tpnaymadn
-
MD5
8cc223e6cc55de1d025e392e7010cc67
-
SHA1
4780ecdd57953baf942bd02e074f64afd64cd103
-
SHA256
4f35c50ec3a7099c8058d999c4c8756f0230dc9c68760b61156586031fe52db3
-
SHA512
d0d54c3d2843acf7e088e41a811455ec4bf8755a3a5467ce3086675a4e8e03cc942f7152a2f450a3b15ec8b37b334b0f1bb515ad327d9077cb1d3b489812e5d5
Static task
static1
Behavioral task
behavioral1
Sample
MPU702734-pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
MPU702734-pdf.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pss.net.pk - Port:
587 - Username:
info@pss.net.pk - Password:
AnisAhmed1980
Targets
-
-
Target
MPU702734-pdf.exe
-
Size
29KB
-
MD5
7ca4655dff0318fa097429f12c5f5c5a
-
SHA1
d48404a0bed433fdec9868e57ef561c53e74a9e7
-
SHA256
f3f681c71b259b83868bf64d9cbd877ddef4b78fb67b91e899e0d970e5e5de66
-
SHA512
0bcaaedef0e707a56a773750c82b614da71148e531d1735989f62dcf5d4e78de7dd4c397201c481b7cca782ff9d356d00f7fdc673399c21d66a4fe6e0b4d0988
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-