General
-
Target
PO.8956.arj
-
Size
475KB
-
Sample
211022-jkykasbcd4
-
MD5
11d8ac6872e9887b004aa4a5ef191c6d
-
SHA1
3578536f235b21d0af144c17d585ac371a016c30
-
SHA256
538116d5dfc2c8b74a74ebf1b7d1b77bc66ef92613983c69c6987cc888935550
-
SHA512
8f39a8da4283ff18fbe98bf173aba64af39b88d973f4f62cd952d7237d56dfeae9c211e0ac2b8faefd384742529987d1ec4444409898210c7d6d8b8c7cd764bb
Static task
static1
Behavioral task
behavioral1
Sample
PO.8956.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PO.8956.exe
Resource
win10-en-20211014
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
ku0385547@gmail.com - Password:
iambless@070
Targets
-
-
Target
PO.8956.exe
-
Size
843KB
-
MD5
8d6bf73a7448adf11ca5f2cf766a9898
-
SHA1
6c157b632a674b4d257d8bcf0fbc4f827a3861fc
-
SHA256
71e6a270b356bc75968b35c54dc53c7b0ce03519e8fbd1821814438810b84e51
-
SHA512
ba9b60b0e4d4a1aa42c81e11a2e9c046c664f3447d34b846356d8ca692972ac6285c721fc401816686c720ec6ad26425f8820c45e94712ea2c35d6e32cac1f5d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-