General
- Target Invoice Packing list.exe
- Size 251KB
- Sample221007-qb3afscef6
- SHA256 fb9bbef98b7ffc2a00f3bbb33e55f58eaf3db1f255c61376c9f6eb52e867f81c
- MD5 c414f6949ab8345a83fbc0725b03b6ab
- SHA1 eceba12417a9f070bea97439675e635512d29e0f
- SHA512 1d09d4b4134fbcf2dde5df8abe81027f60d27887e50512387358adf58239a26b13a6f0ce5f67f51480510204aaf531f8b8bcd962fa5944794c57692f4c1d8535
- SSDEEP 6144:5WQ8eWnxswCvPwPHvsZy6/ir+QV58W2OL0Mno/3nSgrt:tfsxs3iPKb/Q+Qr8WJLnn5gr
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
Invoice Packing list.exe
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoice Packing list.exe
Resource
win10v2004-20220901-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
C2
-
https://api.telegram.org/bot5357159221:AAEuOoQ0pUc4ccIZou0EJ5Zin0mMneE2jYg/
Targets
-
- Target Invoice Packing list.exe
- Size 251KB
- SHA256 fb9bbef98b7ffc2a00f3bbb33e55f58eaf3db1f255c61376c9f6eb52e867f81c
- MD5 c414f6949ab8345a83fbc0725b03b6ab
- SHA1 eceba12417a9f070bea97439675e635512d29e0f
- SHA512 1d09d4b4134fbcf2dde5df8abe81027f60d27887e50512387358adf58239a26b13a6f0ce5f67f51480510204aaf531f8b8bcd962fa5944794c57692f4c1d8535
- SSDEEP 6144:5WQ8eWnxswCvPwPHvsZy6/ir+QV58W2OL0Mno/3nSgrt:tfsxs3iPKb/Q+Qr8WJLnn5gr
- MD5 SHA1 SHA512 SSDEEP
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext