General
-
Target
INVOICE.pdf.exe
-
Size
644KB
-
Sample
230802-hal8vaec5t
-
MD5
bfe696413171e787e364fb24e8324014
-
SHA1
68c74871ac884ba814f174c2a095549686dcbe52
-
SHA256
ff2dbc879b2c5fd96099aca696e8caa5af1a99b2915cb257ffe66a860b909b8e
-
SHA512
967f547877f43ae6837f07302c5f9b2e3a5873283d78bb804a7d7606aee41db1050b4e341316d9e79ff4b2f0bd584adc3f2b73c915681fee5a90884bcbc93e88
-
SSDEEP
12288:0vgNZ2DHWKKwZp4U5bidNVPDUsO5fy6G/pC2z00J7nhEhuvBHDHj:ogvItZO2aYsAjmhfP
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.pdf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
INVOICE.pdf.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
JUGCRsm9 - Email To:
[email protected]
Targets
-
-
Target
INVOICE.pdf.exe
-
Size
644KB
-
MD5
bfe696413171e787e364fb24e8324014
-
SHA1
68c74871ac884ba814f174c2a095549686dcbe52
-
SHA256
ff2dbc879b2c5fd96099aca696e8caa5af1a99b2915cb257ffe66a860b909b8e
-
SHA512
967f547877f43ae6837f07302c5f9b2e3a5873283d78bb804a7d7606aee41db1050b4e341316d9e79ff4b2f0bd584adc3f2b73c915681fee5a90884bcbc93e88
-
SSDEEP
12288:0vgNZ2DHWKKwZp4U5bidNVPDUsO5fy6G/pC2z00J7nhEhuvBHDHj:ogvItZO2aYsAjmhfP
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-