General
- Target ENQUIRY - PR-009583POWER.pdf.exe
- Size 266KB
- Sample230726-gpqzxaaa2t
- SHA256 fa77fd0bc332cc52417da2001bbfee518d2d6cb6c363d15e67d1417afe784325
- MD5 f6d03b23a1cd4b0ce42ebf591b85a514
- SHA1 30906b2343ce4c5f51abecf743171ce96ad399a6
- SHA512 b5916bd34d4251078fcd1f01c5ace30ed1d214e2c7762f588a5b7401a61b3ede5908670d2903c69a40006fbcc992ce1001278ea5898781c159e353fbcc786634
- SSDEEP 6144:/Ya6SXvPueKovTHX8FGR5lSfrNOdWghqLm0tN:/YcXvmDuTMFM5lSVghqLFtN
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
ENQUIRY - PR-009583POWER.pdf.exe
Resource
win7-20230712-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ENQUIRY - PR-009583POWER.pdf.exe
Resource
win10v2004-20230703-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target ENQUIRY - PR-009583POWER.pdf.exe
- Size 266KB
- SHA256 fa77fd0bc332cc52417da2001bbfee518d2d6cb6c363d15e67d1417afe784325
- MD5 f6d03b23a1cd4b0ce42ebf591b85a514
- SHA1 30906b2343ce4c5f51abecf743171ce96ad399a6
- SHA512 b5916bd34d4251078fcd1f01c5ace30ed1d214e2c7762f588a5b7401a61b3ede5908670d2903c69a40006fbcc992ce1001278ea5898781c159e353fbcc786634
- SSDEEP 6144:/Ya6SXvPueKovTHX8FGR5lSfrNOdWghqLm0tN:/YcXvmDuTMFM5lSVghqLFtN
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext