General
-
Target
f89dd1e045dd98eb68a162984599f5ddf4d8c5ff319ad20c9a822ff5cf5c5bb3
-
Size
464KB
-
Sample
220520-3jce8abhel
-
MD5
f4ad88136f46ef283b4edf2b96730ece
-
SHA1
f00b03afdff99c41c6395c7a14171a1f83ce73a0
-
SHA256
f89dd1e045dd98eb68a162984599f5ddf4d8c5ff319ad20c9a822ff5cf5c5bb3
-
SHA512
58a3b963c2c143feb43fef56c7f1a3498d1d0ea6413c548fe1681bd06ffe146fba7109e53adfd6508f984e385086df13ab234949326a2193c4f3d5228736e0d7
Static task
static1
Behavioral task
behavioral1
Sample
P O 05884-20.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
P O 05884-20.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Targets
-
-
Target
P O 05884-20.pdf.exe
-
Size
583KB
-
MD5
994c6ca8658a5d58f91b5f3993aa4000
-
SHA1
96220f118494e372964806294d205341af5a7dfa
-
SHA256
aabe14b147b240cb1c6bb3f2b55c5abe8126e5507c6b346a07dd426ca1da6fb1
-
SHA512
69f2e8a91000d7f3fe5ae885d4c78c6f0f417d1115e49c1c0570dcd3ad82646eefb0bf3af972645b7e814fe9cc9cd1f4434cf346977ab71f9e9c07b56417ef73
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-