General
-
Target
51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0
-
Size
454KB
-
Sample
220521-n239bshfdp
-
MD5
6896a57e7f992e90e427697f9cb2421d
-
SHA1
bdb58a9cf17b68e508c51677a85166a89e1866b3
-
SHA256
51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0
-
SHA512
7fc6298292daac8ab72663ba65137ade4b446ccf128a84faaead83cc8f717eb79a85736ab8144236d35a4e9432e3098945ebcd56c8ef4a4ac5543a871daf19d2
Static task
static1
Behavioral task
behavioral1
Sample
Order# 1391914.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order# 1391914.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Targets
-
-
Target
Order# 1391914.pdf.exe
-
Size
866KB
-
MD5
c2a67ac35ee618dca130790dd9ae2d3b
-
SHA1
7c0ab3ca064486c51c3df1bc1998315ab2c9adcb
-
SHA256
b4c84cf915c0f29a82c0fa8d9e7c7940338ebedf458ce7d4b187935bd5ba9e82
-
SHA512
bff70a1d395a470b1f2d134f1246f042ae9fa11953ebaa6f5359dc8d2f8361af1bc37498307dfc0f120a35b2c6143ea24cf48ff0f6934de7a5bcc8ed0e9779fd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-