General
- Target invoice.exe
- Size 503KB
- Sample201109-4pnsdtleme
- SHA256 e1ff434ecce0bc608bbbb204def5a11548e2b0e9105979d9b6c01486d7768e5c
- MD5 4ffda8f0413d83e3d3f0f4badbf00656
- SHA1 cc655f1bad0b1174beca6fbd672854e1882a8ca6
- SHA512 5ef118407813e4a4427474905fb6496d1d3e2d0acd8d63e74acc67afbbe6431753d2b7dff221fcc8f1be5341d328cb1c4543cec4f239c7f720f17762f69eabd9
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
invoice.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
invoice.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
dal-shared-56.hostwindsdns.com
-
Port
587
-
Username
-
Password
Ripon @ 1971
Extracted
Credentials
-
Protocol
smtp
-
Host
dal-shared-56.hostwindsdns.com
-
Port
587
-
Username
-
Password
Ripon @ 1971
Targets
-
- Target invoice.exe
- Size 503KB
- SHA256 e1ff434ecce0bc608bbbb204def5a11548e2b0e9105979d9b6c01486d7768e5c
- MD5 4ffda8f0413d83e3d3f0f4badbf00656
- SHA1 cc655f1bad0b1174beca6fbd672854e1882a8ca6
- SHA512 5ef118407813e4a4427474905fb6496d1d3e2d0acd8d63e74acc67afbbe6431753d2b7dff221fcc8f1be5341d328cb1c4543cec4f239c7f720f17762f69eabd9
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext