General
-
Target
28309e4e3c453cd24fa4bfd845d1d1e5929bbe824e596d7f8a900dba2f8f7312
-
Size
598KB
-
Sample
240327-cnr4csac35
-
MD5
d2a9c3641a467309044abf24d261e661
-
SHA1
84f52c2a0b911dd4c8dac1b80ae8046c5eacde0e
-
SHA256
28309e4e3c453cd24fa4bfd845d1d1e5929bbe824e596d7f8a900dba2f8f7312
-
SHA512
17142941602d99e036da6924b77874697d00f6cc635b17e80380eac17de422609c5451107064b48929c6027d0d53b19c0253ac9a0e7ef9cb3e1138df012c921a
-
SSDEEP
12288:WrILX1yIgSPCh/u0bQKmL+7IvAQPfUl9T9F/8HILEPLOnGw0bNiW:W+yIgSSuekCKAsO9T9d8HILWOGwWcW
Static task
static1
Behavioral task
behavioral1
Sample
NEW PO PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NEW PO PDF.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sintecno.gr - Port:
587 - Username:
[email protected] - Password:
k$&v8@,q0Pf# - Email To:
[email protected]
Targets
-
-
Target
NEW PO PDF.exe
-
Size
612KB
-
MD5
364756be847b771d192a12d100261d38
-
SHA1
8525b8df98caa2bfccdeeb551559156ee935b63e
-
SHA256
53a6a1dd72f1014e83ecbed0adcf91aa90db1d0007af450102ca9dc3c5216930
-
SHA512
a735f96e55ea85a7214c511580f7f6208fb7055e8e470108f677f72be40af18d638d588fc15a5fd602c490b1797e412c2a82ad8daa499c7a9a9128303f79b2f2
-
SSDEEP
12288:J24i1GnyXIEnaQPBC//O0bwAcL+pavAQPfUlfj9PP4HbPzEFKv1da5W:JmGyXIBQPIOe2CSAiOfj934HbrEk
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-