General
-
Target
5b29c0230dbea96a536e4b6cbf7f78f6fffa00f497335b2867d091be5b0549cf
-
Size
547KB
-
Sample
220520-2g47safch7
-
MD5
74e5e8eea82a0285eadb9398871a538f
-
SHA1
505932d2d2d7cb8e035162aee5d0b305f313df27
-
SHA256
5b29c0230dbea96a536e4b6cbf7f78f6fffa00f497335b2867d091be5b0549cf
-
SHA512
4c8585e497a64f46b7251402bcbdc7e94b18c1ffcd94da25e067447ca0488c0a8f529237e9155bea8d1cbbdd1dbdaee052abf69f8c52fdd463583c0ee12436a6
Static task
static1
Behavioral task
behavioral1
Sample
outstanding invoices.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
outstanding invoices.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.shirdilog.com - Port:
587 - Username:
[email protected] - Password:
SL094521
Targets
-
-
Target
outstanding invoices.exe
-
Size
582KB
-
MD5
8ff183d520904fdef16fc97889c7970d
-
SHA1
1d053e0da0a83aa2ff666d621955572dc8009a6e
-
SHA256
9a5e37882b4c64b00eccc5fce6b8f66dd7d87c786d491bb13a448506ba6aec94
-
SHA512
e0420636a23695039b5013d7c7db6ba50a31ccedbe451a0b2b2e487288532fba9882953aded2b4e183f3fc4238f86c1772b470d1b9efddc403e1f984a8a12835
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-