General
-
Target
Ord 2354 png.zip
-
Size
593KB
-
Sample
210721-mdsa7xtz66
-
MD5
a0624ac492c63227fc9f5bca44d50ea9
-
SHA1
d7d918ed7a20f70e607f248ee9009dc4e89cdfae
-
SHA256
1b77b2cbdb4bd38d7d9f6c1e5d5356ca5f7de8c74813d113b4a02c2b19be87f9
-
SHA512
703ded0af3b701e81dc4f7ad307f4b84746c726b01f56d27918dab6b17e8312d4cecffe42234dd22a19e6a1ae50af8438bca58115f150b8e373496fd00342517
Static task
static1
Behavioral task
behavioral1
Sample
Ord 2354 png.exe
Resource
win7v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.palletsolutions.ca - Port:
587 - Username:
[email protected] - Password:
h~Q+QV.(M2?!
Targets
-
-
Target
Ord 2354 png.exe
-
Size
841KB
-
MD5
48af5cf24f8c7fc448ecbfd55d18f426
-
SHA1
e3cf38df72fda964da45323b60bc9bd88abbee15
-
SHA256
4e9cbaacb1aaed119e375ac6799f97162442f24a14785e2371b44c5e76125abb
-
SHA512
378572ffde0731fd3e27761be19741548b3d82d6208542c124f4db415380453d67cec00b297932e8f7a2a02c784c289a62fee1df859372da0eccabdd1ccb30f2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-