General
-
Target
PO.01948725_pdf.exe
-
Size
299KB
-
Sample
221207-p4mvssaa9s
-
MD5
6ba4f0f360a3c3b983ebe85c14a1006e
-
SHA1
da572bd099a7460175eedf87740307f17ece548c
-
SHA256
1e52736e367a32baa3f72762da49a9987451874e34f4fbcc8d4afcf15a91e537
-
SHA512
50567afbd606efbf5f4c8ce5b7cceddeec6cf96a62f78797794f1540244486cc2d32e4680aab777fe709df887ada4b9e385c13a33e78bf269140dbc94f3946d6
-
SSDEEP
6144:LBnbD9HzWWm32E2JKsOpkE7LN/rxREPlpYh/a5Kor2Q583ryomDg3:FD9yr25KsOpk0nNMrf5UtmDW
Static task
static1
Behavioral task
behavioral1
Sample
PO.01948725_pdf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO.01948725_pdf.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
PO.01948725_pdf.exe
-
Size
299KB
-
MD5
6ba4f0f360a3c3b983ebe85c14a1006e
-
SHA1
da572bd099a7460175eedf87740307f17ece548c
-
SHA256
1e52736e367a32baa3f72762da49a9987451874e34f4fbcc8d4afcf15a91e537
-
SHA512
50567afbd606efbf5f4c8ce5b7cceddeec6cf96a62f78797794f1540244486cc2d32e4680aab777fe709df887ada4b9e385c13a33e78bf269140dbc94f3946d6
-
SSDEEP
6144:LBnbD9HzWWm32E2JKsOpkE7LN/rxREPlpYh/a5Kor2Q583ryomDg3:FD9yr25KsOpk0nNMrf5UtmDW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-