General
-
Target
MPU702734-pdf.exe
-
Size
29KB
-
Sample
210722-x2tfsm47cj
-
MD5
7ca4655dff0318fa097429f12c5f5c5a
-
SHA1
d48404a0bed433fdec9868e57ef561c53e74a9e7
-
SHA256
f3f681c71b259b83868bf64d9cbd877ddef4b78fb67b91e899e0d970e5e5de66
-
SHA512
0bcaaedef0e707a56a773750c82b614da71148e531d1735989f62dcf5d4e78de7dd4c397201c481b7cca782ff9d356d00f7fdc673399c21d66a4fe6e0b4d0988
Static task
static1
Behavioral task
behavioral1
Sample
MPU702734-pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
MPU702734-pdf.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pss.net.pk - Port:
587 - Username:
info@pss.net.pk - Password:
AnisAhmed1980
Targets
-
-
Target
MPU702734-pdf.exe
-
Size
29KB
-
MD5
7ca4655dff0318fa097429f12c5f5c5a
-
SHA1
d48404a0bed433fdec9868e57ef561c53e74a9e7
-
SHA256
f3f681c71b259b83868bf64d9cbd877ddef4b78fb67b91e899e0d970e5e5de66
-
SHA512
0bcaaedef0e707a56a773750c82b614da71148e531d1735989f62dcf5d4e78de7dd4c397201c481b7cca782ff9d356d00f7fdc673399c21d66a4fe6e0b4d0988
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-