General
-
Target
675899234.pdf.exe
-
Size
594KB
-
Sample
211022-gakvcabbe3
-
MD5
9f7e59995263b92231ca69911bc9d20e
-
SHA1
a79d7e3f0a49ec5324d8631d41f46a833d3a520e
-
SHA256
3e8eb7a331ed3b1699d2138aecfa519cb744b9eccb52909420d3d3bed9a3ca05
-
SHA512
b9a1c3d87ad255ec7baa65665ac1b6004a737f0e411b89d38b8f8a796bbc9b882010fed2b4fec5b5b39f49dfc65718caafdcf569030d04d971631617c5a179e8
Static task
static1
Behavioral task
behavioral1
Sample
675899234.pdf.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
675899234.pdf.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.vector-kl.com - Port:
587 - Username:
amin@vector-kl.com - Password:
AminVectorKL202)
Targets
-
-
Target
675899234.pdf.exe
-
Size
594KB
-
MD5
9f7e59995263b92231ca69911bc9d20e
-
SHA1
a79d7e3f0a49ec5324d8631d41f46a833d3a520e
-
SHA256
3e8eb7a331ed3b1699d2138aecfa519cb744b9eccb52909420d3d3bed9a3ca05
-
SHA512
b9a1c3d87ad255ec7baa65665ac1b6004a737f0e411b89d38b8f8a796bbc9b882010fed2b4fec5b5b39f49dfc65718caafdcf569030d04d971631617c5a179e8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-