General
-
Target
hesaphareketi-01.pdf.exe
-
Size
769KB
-
Sample
210727-s4xbnwwwee
-
MD5
2c688cbecffc0a28e2ba5a30a1bdfd01
-
SHA1
53ce765143092d7c2cd23c9e0391abaf45ca3ef4
-
SHA256
0bb7ce952f7357a61b26a358f520f14b742625dca3b6214bba6f85da18caa200
-
SHA512
0b2198bac6a9eb4a317be3355169e91b724bfa96f9aad0c9e44083d250c9fd478cf478b886d9dc4348c85de16d4c9760eabe075e4b0a932784a44c1d85306463
Static task
static1
Behavioral task
behavioral1
Sample
hesaphareketi-01.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
hesaphareketi-01.pdf.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cairoshippinginternational.com - Port:
587 - Username:
samy@cairoshippinginternational.com - Password:
NermoSamy@2006+
Targets
-
-
Target
hesaphareketi-01.pdf.exe
-
Size
769KB
-
MD5
2c688cbecffc0a28e2ba5a30a1bdfd01
-
SHA1
53ce765143092d7c2cd23c9e0391abaf45ca3ef4
-
SHA256
0bb7ce952f7357a61b26a358f520f14b742625dca3b6214bba6f85da18caa200
-
SHA512
0b2198bac6a9eb4a317be3355169e91b724bfa96f9aad0c9e44083d250c9fd478cf478b886d9dc4348c85de16d4c9760eabe075e4b0a932784a44c1d85306463
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Suspicious use of SetThreadContext
-