General
-
Target
4a699ee3382696d02e1914901f4de1c6a46d06e1bd1e76263fcd2d0505ff2d1d
-
Size
506KB
-
Sample
220520-2y7dgagcc9
-
MD5
90d6b947d7d6b239a7400d68cb14a198
-
SHA1
7d0a52fab7495cad4f07d095dea01e3e4f81beb6
-
SHA256
4a699ee3382696d02e1914901f4de1c6a46d06e1bd1e76263fcd2d0505ff2d1d
-
SHA512
3247ca515f38cc07b7876cd6dc8fa3bb8bc89785a3f9edca99e47d3a1dc22362b6135e68da34624d79f3055f060162a4e70f03198b356ae2ad1986fae52ae268
Static task
static1
Behavioral task
behavioral1
Sample
Detalles del banco Pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Detalles del banco Pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
lFAvm@p#@z92
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
lFAvm@p#@z92
Targets
-
-
Target
Detalles del banco Pdf.exe
-
Size
548KB
-
MD5
d367775b90921b2d36296036bac6a255
-
SHA1
897618f155cfb5b5f580f3b08751ff9b4fb5c5e8
-
SHA256
74fb0be9b7d5f5e5a39ddf596dfb3357deb458b7b4340be8f0ce8c4ae819f3de
-
SHA512
74f0a82c5542308ad66065319a206144a73eb95c32ae22e8e807a9e326eb6e91add2c8455aded2607eb2f268cb4a0560698126b9c2bcbb71423f549da7016d2b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-