General
-
Target
45fddbaea4d1635fc9b92498ed3f144ee8be5366f9cc7005dfc3534bcbb51d42
-
Size
480KB
-
Sample
220521-axhj6sdhgj
-
MD5
681d6d7d89984edd00b63c2ce935d5bd
-
SHA1
c3c3efd056964e5c0da190255971f77f39002907
-
SHA256
45fddbaea4d1635fc9b92498ed3f144ee8be5366f9cc7005dfc3534bcbb51d42
-
SHA512
fc81278beb400e7a34e59db9308acb919616ddb6a40ac5fc58cd278a41c8167883ab087b6c226af58d864526557b831d5eacdbdc5d7c23dca7a1f9322cdcc537
Static task
static1
Behavioral task
behavioral1
Sample
PO# M26804.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO# M26804.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Targets
-
-
Target
PO# M26804.pdf.exe
-
Size
697KB
-
MD5
2c5d9104790358f612354abeb705e598
-
SHA1
5289a67a4e1b77b0af28f2e64fb413d843532db6
-
SHA256
66c6414f4a169a4ca29b2952c76eca04c90add82afaa5410c8f447e39481853a
-
SHA512
f3864ab8e027a8ed4ed035fe663844190120855569ced0a74d406d0a88464396e76c9d310a45ac357530934f414ee0a765282f4016a17cbfdf37f792451eecc1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-