General
- Target Revised Invoice pdf.exe
- Size 975KB
- Sample210512-7vsdvccft6
- SHA256 77ccf33c233dd2f10f699699ca25eff2c6da889962f898b244244a1df4ebc806
- MD5 7b359b685d78963d26f7edb9dd07e4c0
- SHA1 841585401e3e1b48378f11dd02b3552533d39afb
- SHA512 241aa5224b4139fa7cfc70e2de525ac5f28f16e3289bdab18344410913072adcc55810c6cad32a62288ebea2125f8058e9cbbb3bb6fbfc1b36dc2d0aacd36b83
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Revised Invoice pdf.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Revised Invoice pdf.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.esquiresweaters.com
-
Port
587
-
Username
-
Password
Esquire@#2078
Targets
-
- Target Revised Invoice pdf.exe
- Size 975KB
- SHA256 77ccf33c233dd2f10f699699ca25eff2c6da889962f898b244244a1df4ebc806
- MD5 7b359b685d78963d26f7edb9dd07e4c0
- SHA1 841585401e3e1b48378f11dd02b3552533d39afb
- SHA512 241aa5224b4139fa7cfc70e2de525ac5f28f16e3289bdab18344410913072adcc55810c6cad32a62288ebea2125f8058e9cbbb3bb6fbfc1b36dc2d0aacd36b83
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext