General
- Target SIGNED INVOICE.exe
- Size 1.4MB
- Sample201109-5apypmd2xj
- SHA256 5a443b824484b636c9436fd13eafb112d3fad00aafe036fb2004f7c3a12852e8
- MD5 6a8586937812b04f0a29d925d009215d
- SHA1 1f9536592da7d5386a36733afd2ca5305a5b5476
- SHA512 ba08e92a35a38adb835d815553fabda9821bb144d8277b427dbb02e9996d302a05966402e91145267ac77d39c3dd5e8786612cfa6b69d40fa36c041f9b77a8b4
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SIGNED INVOICE.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SIGNED INVOICE.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
mpjw2013
Extracted
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
mpjw2013
Targets
-
- Target SIGNED INVOICE.exe
- Size 1.4MB
- SHA256 5a443b824484b636c9436fd13eafb112d3fad00aafe036fb2004f7c3a12852e8
- MD5 6a8586937812b04f0a29d925d009215d
- SHA1 1f9536592da7d5386a36733afd2ca5305a5b5476
- SHA512 ba08e92a35a38adb835d815553fabda9821bb144d8277b427dbb02e9996d302a05966402e91145267ac77d39c3dd5e8786612cfa6b69d40fa36c041f9b77a8b4
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext