General
-
Target
OrderExport_URB202061165400.exe
-
Size
663KB
-
Sample
201109-w7lqeppkra
-
MD5
0eb06e938875e8bb4bfe14a94c6712df
-
SHA1
23a8e2badc0403aec721990c066771e20e1a5904
-
SHA256
cb29def3c7c961ecae3bb6cda5aebc5210828401fc97a4f9b61711a0d1c2ae2c
-
SHA512
9959db6860a6ff0f67301df994e411d4d3b3345ecaf36f4bf5cdccb8fbcfb44a86bcf6a2a80709746a27b414811c60b304b4ea745b55313cc1e797e49acc7d81
Static task
static1
Behavioral task
behavioral1
Sample
OrderExport_URB202061165400.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
OrderExport_URB202061165400.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sesan.com.vn - Port:
587 - Username:
info@sesan.com.vn - Password:
123456
Extracted
Protocol: smtp- Host:
mail.sesan.com.vn - Port:
587 - Username:
info@sesan.com.vn - Password:
123456
Targets
-
-
Target
OrderExport_URB202061165400.exe
-
Size
663KB
-
MD5
0eb06e938875e8bb4bfe14a94c6712df
-
SHA1
23a8e2badc0403aec721990c066771e20e1a5904
-
SHA256
cb29def3c7c961ecae3bb6cda5aebc5210828401fc97a4f9b61711a0d1c2ae2c
-
SHA512
9959db6860a6ff0f67301df994e411d4d3b3345ecaf36f4bf5cdccb8fbcfb44a86bcf6a2a80709746a27b414811c60b304b4ea745b55313cc1e797e49acc7d81
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-