General
- Target PAYMENT SLIP.exe
- Size 1.0MB
- Sample220412-mw82ysagbl
- SHA256 8dd1b5caf0cd6f4d0972591216d4898f1a9dd4dbae2a2b5c92cc568d561cd144
- MD5 765a397dd23048189ba17c85d4d57535
- SHA1 724ab5d57541aa87b97ff24270c63abf49ed170f
- SHA512 a6fb1cb1acf882eedc124244cf3498d3c4567a81f3a49d1f0ce7f078015b76404af1473d1b0b65a6b26ab8773b731c2eabc6652a4c740d12a447d6802aa9a7a5
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT SLIP.exe
Resource
win7-20220331-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PAYMENT SLIP.exe
Resource
win10v2004-20220331-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot5250223416:AAG8kAOQx4wssXczXLpw9iZDG330B1RusH8/sendDocument
Targets
-
- Target PAYMENT SLIP.exe
- Size 1.0MB
- SHA256 8dd1b5caf0cd6f4d0972591216d4898f1a9dd4dbae2a2b5c92cc568d561cd144
- MD5 765a397dd23048189ba17c85d4d57535
- SHA1 724ab5d57541aa87b97ff24270c63abf49ed170f
- SHA512 a6fb1cb1acf882eedc124244cf3498d3c4567a81f3a49d1f0ce7f078015b76404af1473d1b0b65a6b26ab8773b731c2eabc6652a4c740d12a447d6802aa9a7a5
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext