General
-
Target
MV AL HANI PDA LINER OUT CHARGES - AGENT APPOINTMENT LOADING.cab
-
Size
350KB
-
Sample
210421-hjbmm319fj
-
MD5
ed2dd257ad5387b8ad144253056adb8b
-
SHA1
4b736998cc825bb2e92ceb151ce764244e068a99
-
SHA256
c20ec317d4336fca32c5205e025a4b2bad3b3b78cafb7c12acc8536c64a2fd3a
-
SHA512
c7b058e1a2b7509f7d955485b2d5e771bdc4d1b45a34781678c5407088ed31296b2c0546ce3b1973cd0b37f46615a9895c178c017ee15c497fcfceec5abe0411
Static task
static1
Behavioral task
behavioral1
Sample
MV AL HANI PDA LINER OUT CHARGES - AGENT APPOINTMENT LOADING.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
MV AL HANI PDA LINER OUT CHARGES - AGENT APPOINTMENT LOADING.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.t7global-my.com - Port:
587 - Username:
manage@t7global-my.com - Password:
KyDCvxSl$2
Targets
-
-
Target
MV AL HANI PDA LINER OUT CHARGES - AGENT APPOINTMENT LOADING.exe
-
Size
460KB
-
MD5
502049e944a8d3bbb0138098597b30e8
-
SHA1
5242d649abb58f4d797bad53c448bd5028a7fdce
-
SHA256
2be649f814ee89705f39489d11d8dc2d32e76ba97cec1f0707edc0ec4b4aa060
-
SHA512
61270a3112f90358050597ddc0c92c70a8d086b42d3e1bcbdabca8751730835f0ccd13ae3536fdcc688fbeedb9d69087acc7bf9d2861a698b68ecce15f164e8d
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Nirsoft
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-