General
-
Target
Cotización-202002721.pdf.exe
-
Size
473KB
-
Sample
230328-vzt17scb98
-
MD5
bf2d6295a7e04f44e50101fd3df6b34f
-
SHA1
223321e3e18c453875f4d625b1327b8a8e05de1a
-
SHA256
c5b618054d855fffed65dc372080cdc5de39ca31edd513e7765a02c64f9b9e1b
-
SHA512
fcec0b125961d7ae9f1672e85e61ff0c58a0aa58a3a0686816c32be0581352c08a7a46b16bbe9073f640d26e81b1cd7a0791aa5ea44380b2defb5342db2f79e6
-
SSDEEP
12288:943FAhu8y7mMaBXkiB/ZrLX/qFiyDwHi220AbWxQhi:e3FSunDuXBX62gvs
Static task
static1
Behavioral task
behavioral1
Sample
Cotización-202002721.pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Cotización-202002721.pdf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.itzayanaland.com - Port:
587 - Username:
security01@itzayanaland.com - Password:
H!S6_PFHTAN{ - Email To:
security01@itzayanaland.com
Targets
-
-
Target
Cotización-202002721.pdf.exe
-
Size
473KB
-
MD5
bf2d6295a7e04f44e50101fd3df6b34f
-
SHA1
223321e3e18c453875f4d625b1327b8a8e05de1a
-
SHA256
c5b618054d855fffed65dc372080cdc5de39ca31edd513e7765a02c64f9b9e1b
-
SHA512
fcec0b125961d7ae9f1672e85e61ff0c58a0aa58a3a0686816c32be0581352c08a7a46b16bbe9073f640d26e81b1cd7a0791aa5ea44380b2defb5342db2f79e6
-
SSDEEP
12288:943FAhu8y7mMaBXkiB/ZrLX/qFiyDwHi220AbWxQhi:e3FSunDuXBX62gvs
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-