General
-
Target
Invoice 1905-20-1907-20.pdf.exe
-
Size
742KB
-
Sample
211024-h4dtkaedak
-
MD5
d40d05b8b73fb36ca9ae679997decbf7
-
SHA1
1099139b29753b0308fd3729a1b0a894fb98b94e
-
SHA256
9509214ef8fd1704c88aebdd75cf26345735cf6901af44de6038dce4e4d46f34
-
SHA512
6c6388214929c2d094584c8ddfe5b116ff6c250e2c32f161d5328a258191e115fca6a10275e7e366a7ab976116e2b2406dbc699c4a5287aac39ee127657d900b
Static task
static1
Behavioral task
behavioral1
Sample
Invoice 1905-20-1907-20.pdf.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Invoice 1905-20-1907-20.pdf.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.topfrozenfoodbrand.com - Port:
587 - Username:
[email protected] - Password:
Chukwudim28@
Targets
-
-
Target
Invoice 1905-20-1907-20.pdf.exe
-
Size
742KB
-
MD5
d40d05b8b73fb36ca9ae679997decbf7
-
SHA1
1099139b29753b0308fd3729a1b0a894fb98b94e
-
SHA256
9509214ef8fd1704c88aebdd75cf26345735cf6901af44de6038dce4e4d46f34
-
SHA512
6c6388214929c2d094584c8ddfe5b116ff6c250e2c32f161d5328a258191e115fca6a10275e7e366a7ab976116e2b2406dbc699c4a5287aac39ee127657d900b
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-