General
- Target VAT INVOICE.exe
- Size 650KB
- Sample210408-vg8ykf9j7x
- SHA256 adde82ed8c5814b91f07af5fe44f30aced3455cc52d6490b19aa822bde1b2e6b
- MD5 ed9f7f4141cd85650393d16b2bad6de4
- SHA1 fcdddbcfb7089035853a0b109304612658f9d789
- SHA512 5e10f11c2a31328ae7ea85eaf9f945752faa8134affd9f563fa504cabad40b0f446d2a221fd4161843d1697764068ee84522e1a7b556ffe6cadf0ba48d1c0494
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
VAT INVOICE.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
VAT INVOICE.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.lokalboyz.com
-
Port
587
-
Username
-
Password
lkEb6ovn
Targets
-
- Target VAT INVOICE.exe
- Size 650KB
- SHA256 adde82ed8c5814b91f07af5fe44f30aced3455cc52d6490b19aa822bde1b2e6b
- MD5 ed9f7f4141cd85650393d16b2bad6de4
- SHA1 fcdddbcfb7089035853a0b109304612658f9d789
- SHA512 5e10f11c2a31328ae7ea85eaf9f945752faa8134affd9f563fa504cabad40b0f446d2a221fd4161843d1697764068ee84522e1a7b556ffe6cadf0ba48d1c0494
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Suspicious use of SetThreadContext