General
-
Target
SHIPPING DOCUMENTS_PDF.zip
-
Size
551KB
-
Sample
210927-w6pwhahggr
-
MD5
3d202a162f53e84590a03098cf858c46
-
SHA1
b6e112997bcfcbe4f012fc946303b857373c9998
-
SHA256
34c0039596d87348848d0a28efe6d3fa77155df9cd8571eed952abe9e254f266
-
SHA512
d13d1b09b1beb86b45ed3af47c36e4f6dd8d85ac0aa5ea5fd4c87bd3fea888b346c9de4143d6bead0256c359a2d89fe2163bd606dbf78c1e7f1bdd2fcdff3035
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENTS_PDF.exe
Resource
win7v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.it-tel.eu - Port:
587 - Username:
[email protected] - Password:
OZuw)N$0
Targets
-
-
Target
SHIPPING DOCUMENTS_PDF.exe
-
Size
850KB
-
MD5
ff8964351ff2ef7ae003d14cd494efb3
-
SHA1
cff664fffb5c470d4d2ff5dbbdc198276cc77634
-
SHA256
95e22edcb0a13b44fe04a41017a585c67faf91b47177887b40b1b6190599b4ae
-
SHA512
2455338bd54e74bdcbcd781158f3888988a77040cf768e4295e25c56800411a76fda65fbf074d8d2edba4cea3e80b9942dee54e9634b98e9d13dad8d26287226
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Drops file in Drivers directory
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-