General
- Target invoice copy.pdf.exe
- Size 524KB
- Sample210518-rvm4mkt98e
- SHA256 f4c05b03d057e5d16ef1297e82644f3ea39c77aab42eb6e836b2d33ff4e3d9e0
- MD5 b9787b62278a03fda1950ab9e41cd4e6
- SHA1 0958b8e0100e2f2d888fcf1a179e0397bcad5bf6
- SHA512 d249c2e2ea7f91fa1f6b8f63892e704985e8317d16c3b9635321f12260ee06643cb3dcbfa6820ad7ba31d9a07645a4b08914830b6877961b73c5ea3a5dd8c2c1
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
invoice copy.pdf.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
invoice copy.pdf.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.targethyd.com
-
Port
587
-
Username
-
Password
marketing369456
Targets
-
- Target invoice copy.pdf.exe
- Size 524KB
- SHA256 f4c05b03d057e5d16ef1297e82644f3ea39c77aab42eb6e836b2d33ff4e3d9e0
- MD5 b9787b62278a03fda1950ab9e41cd4e6
- SHA1 0958b8e0100e2f2d888fcf1a179e0397bcad5bf6
- SHA512 d249c2e2ea7f91fa1f6b8f63892e704985e8317d16c3b9635321f12260ee06643cb3dcbfa6820ad7ba31d9a07645a4b08914830b6877961b73c5ea3a5dd8c2c1
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext