General
-
Target
Invoice_PDF.exe
-
Size
571KB
-
Sample
211202-rrwy2shfgl
-
MD5
1dcc43f272f66d8e5afe11e7276dd122
-
SHA1
cb6a88d1443e7cca944a4176e2a8ebc205f715e3
-
SHA256
0c6a99b9327cbcb0f3c5b18bc93d347ec8adcb3686e562c515ee4388713e8ed7
-
SHA512
d3b4b4c93a0b1be2b3effe11e1a4db954f65dc9edf722310ee43defa5cecce6f717fc518b9735c71ef4fac53202c3d314ee6e7e0aab789bc881e4eab6e65a111
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_PDF.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Invoice_PDF.exe
Resource
win10-en-20211104
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/sendDocument
Targets
-
-
Target
Invoice_PDF.exe
-
Size
571KB
-
MD5
1dcc43f272f66d8e5afe11e7276dd122
-
SHA1
cb6a88d1443e7cca944a4176e2a8ebc205f715e3
-
SHA256
0c6a99b9327cbcb0f3c5b18bc93d347ec8adcb3686e562c515ee4388713e8ed7
-
SHA512
d3b4b4c93a0b1be2b3effe11e1a4db954f65dc9edf722310ee43defa5cecce6f717fc518b9735c71ef4fac53202c3d314ee6e7e0aab789bc881e4eab6e65a111
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-