General
-
Target
Order#732B9_130321 Pdf.exe
-
Size
938KB
-
Sample
210727-e5swv73wt6
-
MD5
193cd9e42d452e3523d04654c0ca883f
-
SHA1
e13557a7ea1c29e4376187eccc9d000290cfb32c
-
SHA256
d3eb7e966bf389f4139c625dea6d218f0969440101629a0e11302d0e547dee85
-
SHA512
05425c70d5c785de3f89022f73862f6e568f3b054732ff16d69594268d8417bbdae8cdf0eb6cc98d29177662a2f6e98693f2d8891b9c2ccecda6b147e7e84c92
Static task
static1
Behavioral task
behavioral1
Sample
Order#732B9_130321 Pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Order#732B9_130321 Pdf.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.zoho.com - Port:
587 - Username:
steinlogz@zohomail.com - Password:
JesusChrist007
Targets
-
-
Target
Order#732B9_130321 Pdf.exe
-
Size
938KB
-
MD5
193cd9e42d452e3523d04654c0ca883f
-
SHA1
e13557a7ea1c29e4376187eccc9d000290cfb32c
-
SHA256
d3eb7e966bf389f4139c625dea6d218f0969440101629a0e11302d0e547dee85
-
SHA512
05425c70d5c785de3f89022f73862f6e568f3b054732ff16d69594268d8417bbdae8cdf0eb6cc98d29177662a2f6e98693f2d8891b9c2ccecda6b147e7e84c92
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-