General
- Target Invoice.pdf.exe
- Size 612KB
- Sample230911-hzz61aed79
- SHA256 f6ceb475c843b5339bdd85afc176eba77bf0d7a133afa4e092e3cd9e93889a7a
- MD5 eaf25ba217e18c943a09c2d534ca4efe
- SHA1 1bfccd6fe9b46f43c9056b21c8c1ef4ceb4108e2
- SHA512 1c34a7f2f16aa4db588960ad73ba6c7890121b8973fa725353dcc0b573e0bce58501c1e992db0fa99d0cad087fe864aef5272380704767a899e7bea3cc0a1e23
- SSDEEP 12288:A3t2iNHkDwMD8DYQ8r83sTyQoTOWE95IY9RdmrdL4u:A3t1RkDV8DYQa2fQoTOldm9
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Invoice.pdf.exe
Resource
win7-20230831-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoice.pdf.exe
Resource
win10v2004-20230831-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
JUGCRsm9
-
Email to
Targets
-
- Target Invoice.pdf.exe
- Size 612KB
- SHA256 f6ceb475c843b5339bdd85afc176eba77bf0d7a133afa4e092e3cd9e93889a7a
- MD5 eaf25ba217e18c943a09c2d534ca4efe
- SHA1 1bfccd6fe9b46f43c9056b21c8c1ef4ceb4108e2
- SHA512 1c34a7f2f16aa4db588960ad73ba6c7890121b8973fa725353dcc0b573e0bce58501c1e992db0fa99d0cad087fe864aef5272380704767a899e7bea3cc0a1e23
- SSDEEP 12288:A3t2iNHkDwMD8DYQ8r83sTyQoTOWE95IY9RdmrdL4u:A3t1RkDV8DYQa2fQoTOldm9
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext