General
-
Target
b11a0bce757f636b17b031043666ec08956175dfdea6f7402ed136852d9b618d
-
Size
401KB
-
Sample
220521-pgmaraaebn
-
MD5
f8c5e99f6c4b862d7d9407661fe44f5e
-
SHA1
f5836d64a9d67af4c21a4342a53480447c007bf3
-
SHA256
b11a0bce757f636b17b031043666ec08956175dfdea6f7402ed136852d9b618d
-
SHA512
97ebe31f1bb16af54f583afd14da0a8ccf91cfdea0a9b8c84ffa78b68ba5671a734ad5e99f96db37edf8b4a5262227c26d7f86e13d1eaa96a0de2e976d72648c
Static task
static1
Behavioral task
behavioral1
Sample
invoice.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
invoice.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
chinapeace@yandex.com - Password:
chibuikelightwork1
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
chinapeace@yandex.com - Password:
chibuikelightwork1
Targets
-
-
Target
invoice.pdf.exe
-
Size
439KB
-
MD5
8e8165e74a734ef4504df4fc4b014f8d
-
SHA1
ce43b52541df7cdc3f4053d201517adb447005c9
-
SHA256
f892f7e0b4bcfd9084ac791d72a87a95a16ca175a154faf0a2e24da5dd205bce
-
SHA512
101124fe99affa3944d3fe225c1e3065548c2e0faff42dd58fcfbed295d91e41733a068e6a629aba91ad5c5258565cbd47f2f4544e10d8a418c7ae1edf5cb5f4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-