General
- Target Proforma_invoice.exe
- Size 582KB
- Sample210511-5byrw4qqda
- SHA256 aa8eca13cc8a3bae0616cca54b78e4cc9c19beb27a2a48830f1f86e4b3154a27
- MD5 e41f49ccc0f0d0af5ed98b39067abd2a
- SHA1 79c4f2b0a20878be3e0f4fa435b2aeb03f770232
- SHA512 f0cf73e698dc49636346e34712841ef205431b828329146d051b483a95c0d6e782f357e2490c25530cc1e30dce46ce13b4c4bd94e2a6393efd52edadfe1ae02f
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Proforma_invoice.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Proforma_invoice.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot1437981864:AAFmXsejy8kUC_pj3BwrEvAeb2cv12XMVZI/sendDocument
Targets
-
- Target Proforma_invoice.exe
- Size 582KB
- SHA256 aa8eca13cc8a3bae0616cca54b78e4cc9c19beb27a2a48830f1f86e4b3154a27
- MD5 e41f49ccc0f0d0af5ed98b39067abd2a
- SHA1 79c4f2b0a20878be3e0f4fa435b2aeb03f770232
- SHA512 f0cf73e698dc49636346e34712841ef205431b828329146d051b483a95c0d6e782f357e2490c25530cc1e30dce46ce13b4c4bd94e2a6393efd52edadfe1ae02f
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext