General
- Target PO GNH309.pdf.exe
- Size 660KB
- Sample220131-hlc5baghf9
- SHA256 45c0b5eda3f5bc38f1bdac63a60ded33142355d316e488a19d9d6083dc0306ca
- MD5 33125d9306e79affe11fecaccab6078b
- SHA1 486a155b2ad4163859ff3323d7bb2730766f7b1d
- SHA512 9523eb1dd4da6aa64f5ea64d5358ac6019b3520ede29bd01993d1e1c6a1825f0703948ef71091d252555174487faefe4222b5b980a2fb639516959957adc61b5
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
PO GNH309.pdf.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO GNH309.pdf.exe
Resource
win10-en-20211208
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
marcellinus
Targets
-
- Target PO GNH309.pdf.exe
- Size 660KB
- SHA256 45c0b5eda3f5bc38f1bdac63a60ded33142355d316e488a19d9d6083dc0306ca
- MD5 33125d9306e79affe11fecaccab6078b
- SHA1 486a155b2ad4163859ff3323d7bb2730766f7b1d
- SHA512 9523eb1dd4da6aa64f5ea64d5358ac6019b3520ede29bd01993d1e1c6a1825f0703948ef71091d252555174487faefe4222b5b980a2fb639516959957adc61b5
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext