General
- Target revised invoice and packing list pdf.exe
- Size 1.7MB
- Sample210516-bvwt8bv196
- SHA256 5d89a25cf8029f781b53b9cc617c5067cafe366eb58d0b76ee4246e519f794b0
- MD5 290f9c5600c777852717d8067d4ae783
- SHA1 0c45b1fc5758e00e83f85994a40c2b0c19f910af
- SHA512 390c8b740e71eb238bb904ba09bc4fad25f8c20a2df28c00046d4dfee562bd07341b93c20902b52054b2ff0c70eb4c433b89adcde5bfab66183e363b3bea1446
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
revised invoice and packing list pdf.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
revised invoice and packing list pdf.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.esquiresweaters.com
-
Port
587
-
Username
-
Password
Esquire@#2078
Targets
-
- Target revised invoice and packing list pdf.exe
- Size 1.7MB
- SHA256 5d89a25cf8029f781b53b9cc617c5067cafe366eb58d0b76ee4246e519f794b0
- MD5 290f9c5600c777852717d8067d4ae783
- SHA1 0c45b1fc5758e00e83f85994a40c2b0c19f910af
- SHA512 390c8b740e71eb238bb904ba09bc4fad25f8c20a2df28c00046d4dfee562bd07341b93c20902b52054b2ff0c70eb4c433b89adcde5bfab66183e363b3bea1446
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext