General
- Target payment advice.pdf.exe
- Size 1001KB
- Sample210325-k4s4fxcd76
- SHA256 870eb8a97b16ac3b0f7c259a91be78b86778433e4e06d5f35ad2007427c28749
- MD5 06de32db219e6adf75443458103514e4
- SHA1 a56c98710372cc306c16a0c4a7fd6a1f9407ab78
- SHA512 3d7ccc6f1268a43ca650e8807dc9ea3ad36314f753e7e6fdb705796f0ccbcca7b7355180a12675d90b7dcb2d9488fcedbe60a5c25f89284f2bb0afc6497d9777
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
payment advice.pdf.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payment advice.pdf.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
104socceryandex
Targets
-
- Target payment advice.pdf.exe
- Size 1001KB
- SHA256 870eb8a97b16ac3b0f7c259a91be78b86778433e4e06d5f35ad2007427c28749
- MD5 06de32db219e6adf75443458103514e4
- SHA1 a56c98710372cc306c16a0c4a7fd6a1f9407ab78
- SHA512 3d7ccc6f1268a43ca650e8807dc9ea3ad36314f753e7e6fdb705796f0ccbcca7b7355180a12675d90b7dcb2d9488fcedbe60a5c25f89284f2bb0afc6497d9777
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext