agenttesla | Invoices[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Invoices.exe
Size 217KB
Sample201224-msxpkk56s6
SHA256 b9b2ce68a18db98a1253e9ece1d2d99a030be25ad433ef2dd3889cff53316d99
MD5 2111960d6148d9b9fead1da5fdef6f7a
SHA1 bdc7dcecaa1d96d290cc427fc9b2070c7433bc73
SHA512 7421a6280cc172f6ec1157fd7e0b5025da10254ca99fbc90362116a609372f42a3d8de6a1aa0cd12781da35f7594fcf21c51318d6f0ab206fbb9019a75cf464a
MD5 SHA1 SHA512

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.hemetek.com
Port
587
Username
[email protected]
Password
r_NA-)7XO6MG

Signatures

AgentTesla Payload 1 IoCs

resource	yara_rule
sample	family_agenttesla

Agenttesla family
agenttesla

File Explorer

Invoices.exe

.exe 217KB

Invoices.exe

SHA256 b9b2ce68a18db98a1253e9ece1d2d99a030be25ad433ef2dd3889cff53316d99
MD5 2111960d6148d9b9fead1da5fdef6f7a
SHA1 bdc7dcecaa1d96d290cc427fc9b2070c7433bc73
SHA512 7421a6280cc172f6ec1157fd7e0b5025da10254ca99fbc90362116a609372f42a3d8de6a1aa0cd12781da35f7594fcf21c51318d6f0ab206fbb9019a75cf464a
MD5 SHA1 SHA512

windows x86

AgentTesla Payload