General
- Target SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe
- Size 603KB
- Sample221130-pxbtysbc49
- SHA256 32e235425a71459bee33dffde1c4cb63c4ba379802d618c97f950e94ec2231c0
- MD5 bbd3509ea2aeeaac1c8a1380462c7655
- SHA1 b3d550db2808c5804fb9bc7cf75efdcb6a5dc766
- SHA512 71dc6c147bd70b60143d8f08d457f63ed2de8a316e44bbd111575bfdba8eca27e39d4120739520662f237e166f8a94f0c1e499ecca190652895395a692ead55f
- SSDEEP 12288:Azqc2Nvbl7xQZTFEJMjXVVpEVwsCSsGbHJf8A+/H:AzqnedbF0+s4GbH1Q/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe
Resource
win10v2004-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument
Targets
-
- Target SecuriteInfo.com.Win32.PWSX-gen.16587.30591.exe
- Size 603KB
- SHA256 32e235425a71459bee33dffde1c4cb63c4ba379802d618c97f950e94ec2231c0
- MD5 bbd3509ea2aeeaac1c8a1380462c7655
- SHA1 b3d550db2808c5804fb9bc7cf75efdcb6a5dc766
- SHA512 71dc6c147bd70b60143d8f08d457f63ed2de8a316e44bbd111575bfdba8eca27e39d4120739520662f237e166f8a94f0c1e499ecca190652895395a692ead55f
- SSDEEP 12288:Azqc2Nvbl7xQZTFEJMjXVVpEVwsCSsGbHJf8A+/H:AzqnedbF0+s4GbH1Q/
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Suspicious use of SetThreadContext