General
- Target 3532CORDERCONFIRMATION,pdf.exe
- Size 666KB
- Sample220516-nbd7hsbfgq
- SHA256 e0896f3de4452ba8a69e37e0449fbbbca187f7cadd1dffeef70a8e55f2ae6e6f
- MD5 779cf722377b4e0a080b77ce18f5ded0
- SHA1 8d3813a60beb07b90015919e5795ac635329b484
- SHA512 53f536c1114fbdad41abe6e8097fb0957c8370e24a8f324a965f12c911be4a69b6f937d8c393464e975b09b36312ff8b1b4897338fb58021362bdc72bda495d2
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
3532CORDERCONFIRMATION,pdf.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3532CORDERCONFIRMATION,pdf.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.kursat.com.tr
-
Port
587
-
Username
-
Password
kursat201414
Targets
-
- Target 3532CORDERCONFIRMATION,pdf.exe
- Size 666KB
- SHA256 e0896f3de4452ba8a69e37e0449fbbbca187f7cadd1dffeef70a8e55f2ae6e6f
- MD5 779cf722377b4e0a080b77ce18f5ded0
- SHA1 8d3813a60beb07b90015919e5795ac635329b484
- SHA512 53f536c1114fbdad41abe6e8097fb0957c8370e24a8f324a965f12c911be4a69b6f937d8c393464e975b09b36312ff8b1b4897338fb58021362bdc72bda495d2
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext