General
-
Target
Proforma Invoice.pdf.z
-
Size
394KB
-
Sample
211021-efzjksafgm
-
MD5
a582442c9a9b46a82fc5ee2293007a75
-
SHA1
df8fe8283015a1e767a82af59c677c17cc3a218c
-
SHA256
26353c72d8fc0a44ef425622fb649d57d5ae330e4c96b995124bed0d2209ecd9
-
SHA512
503e4f18a4a64455d1905a789c82d50523f9ef151165c53db2341736bb06dc08bf58619e95d869812e640c6885c85845e4edf87485b771ff1f843165d231bae4
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice.pdf.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Proforma Invoice.pdf.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.daproviaggi.it - Port:
587 - Username:
anna@daproviaggi.it - Password:
vacanz.E43
Targets
-
-
Target
Proforma Invoice.pdf.exe
-
Size
426KB
-
MD5
6e076b569560bf2e25726d56639bbbfe
-
SHA1
73babceee474d401f5f0c36bf71cbb1da7374e7b
-
SHA256
1f641c813dbf32c33e6e6a2b5f50851b967070b9e84cd288f818c6282c8671b2
-
SHA512
0dba29e66219785a9565fc0ef88ec8172f372060a6fa374498aee093e74b4495161ab8f68861004661456457042a11f4d2951db8e28e44bae9f060fe7abf579f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-