General
- Target INVOICE_PRFpdf.exe
- Size 345KB
- Sample210226-6tpwd6raw2
- SHA256 95c008fdb0ff81d4b148fac86341f08e5ee8dc036b4f4a1a6d4140c98ae2a136
- MD5 12cdd8a86151dcd9ef7a7600e4cd27fb
- SHA1 17d46476e72d92bfd0d002f312fd18dc2c164667
- SHA512 5447b2d3b2958eff3b168e08e42856c5cd5015aa7c3e370d31353f5f578c8c663b2553ded992915b3879a5e6f90c4ffdce677c9927d731520b9e97d38030e19c
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE_PRFpdf.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INVOICE_PRFpdf.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Targets
-
- Target INVOICE_PRFpdf.exe
- Size 345KB
- SHA256 95c008fdb0ff81d4b148fac86341f08e5ee8dc036b4f4a1a6d4140c98ae2a136
- MD5 12cdd8a86151dcd9ef7a7600e4cd27fb
- SHA1 17d46476e72d92bfd0d002f312fd18dc2c164667
- SHA512 5447b2d3b2958eff3b168e08e42856c5cd5015aa7c3e370d31353f5f578c8c663b2553ded992915b3879a5e6f90c4ffdce677c9927d731520b9e97d38030e19c
- MD5 SHA1 SHA512
Score10/10AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
AgentTesla Payload
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Suspicious use of SetThreadContext