General
-
Target
b7660854fca9a68c257f983d455de6afa7c91fb63f8e0d9626bcce501c788412
-
Size
396KB
-
Sample
220520-2afkvafaa6
-
MD5
ac28b83080a0d6125c391932fdbfe0e8
-
SHA1
b9ba8a2892c7d852bfc1ed249451a0843c4d14cb
-
SHA256
b7660854fca9a68c257f983d455de6afa7c91fb63f8e0d9626bcce501c788412
-
SHA512
eed2687b6515f01a9ae59c29d019997cf8bebe52c3809a4938f17d4e43a4b72a004c385ee8977ab38672fa460e94843d997cabd61a4ba719067e9364414caf74
Static task
static1
Behavioral task
behavioral1
Sample
PO467.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO467.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.protistha.com - Port:
587 - Username:
[email protected] - Password:
In4mation@
Targets
-
-
Target
PO467.exe
-
Size
481KB
-
MD5
b170dc700fe581697f094f5b3db89cae
-
SHA1
445356ed727561f2e4344f2c8311329ac5157877
-
SHA256
3549a2f711e2afcb12e8d6925c3e4e8888f5dfce8249ced828ec5119f450b5d2
-
SHA512
f7759005a02a9be49ad3570dba58857fccc131cfed9f3064ad8fdb874504c788c40a557168e2c4bbc288d42c50aa9d87d204f3ecd4bd0f37db9fd654f3800687
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-