General
-
Target
Purchase Oder.5645.scan.pdf....exe
-
Size
822KB
-
Sample
211025-pwgzkshadq
-
MD5
4ffb74cefe453deaabfbeb37387eb44d
-
SHA1
373cc4f9481c544a96bbdc9c4bf040797fb79b07
-
SHA256
4f9d5e040e4c87f929fb4480abb54524347caa619d4e0f295a2a440c3426a273
-
SHA512
dc08472816f0896532ca29be901a4c58eeea8208b8544fa0d5ca802ae5faedc65105d4993d3c998d66356819197e31e552858ffa875ef3155919a1a285eab30f
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Oder.5645.scan.pdf....exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Purchase Oder.5645.scan.pdf....exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.szztsa.com - Port:
587 - Username:
[email protected] - Password:
Szzt@2019
Targets
-
-
Target
Purchase Oder.5645.scan.pdf....exe
-
Size
822KB
-
MD5
4ffb74cefe453deaabfbeb37387eb44d
-
SHA1
373cc4f9481c544a96bbdc9c4bf040797fb79b07
-
SHA256
4f9d5e040e4c87f929fb4480abb54524347caa619d4e0f295a2a440c3426a273
-
SHA512
dc08472816f0896532ca29be901a4c58eeea8208b8544fa0d5ca802ae5faedc65105d4993d3c998d66356819197e31e552858ffa875ef3155919a1a285eab30f
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-