General
-
Target
dd03989c6b78abe75f0e14aa27d054fd9b89b0e598de9e3250aa1b024c66d30d
-
Size
639KB
-
Sample
220520-17tcjaegf3
-
MD5
eddf41eef4ad573eebb7e4bb9f4ba755
-
SHA1
820d3e7fb381544a11cfbad108455ef795bda67b
-
SHA256
dd03989c6b78abe75f0e14aa27d054fd9b89b0e598de9e3250aa1b024c66d30d
-
SHA512
0d7de40447409901d747f796d2c08ae1366742e1a2f02967a283df003c53261c3746a4b8bb7b30e138dbc091c6bfc42ac2f6f36eb0b86698f116d6de40ac8138
Static task
static1
Behavioral task
behavioral1
Sample
Attached Proforma-xls.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Attached Proforma-xls.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
company1960
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
company1960
Targets
-
-
Target
Attached Proforma-xls.exe
-
Size
671KB
-
MD5
6d22a496faacb5fd4c4717256c219b5c
-
SHA1
ca2acc40e012b00b007900071cca1e334a49c3d5
-
SHA256
5af795fb7f2afc8329d025b4b5f053942b82c75f4b3796a1a53f77e97e74019d
-
SHA512
91be74d93f503d7763190a1a5f24779bf0b5f721649484928f34fcd97eb3ae310bcad397371df5e1a251a34e46db1be5916fbf467480e28c7a5220121dda19b8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-