General
-
Target
1c61ddda86408d39192c8ad768fb2c0625af5f5cdbca79476e4c9359b61d5648
-
Size
880KB
-
Sample
220520-2mt9rsaffr
-
MD5
f79c12de70519e8e5c5cd6024b81cdb6
-
SHA1
18f12d00a65f2868c9e114f6e2bd03ea790e380a
-
SHA256
1c61ddda86408d39192c8ad768fb2c0625af5f5cdbca79476e4c9359b61d5648
-
SHA512
e3f723905dad038cced8e10947a475ce36f96dd90392aef56b90db628a768b4cdf09f2a697c5e778b90f956c80471ec201562e508df2e0767bd2ac504e3a7b10
Static task
static1
Behavioral task
behavioral1
Sample
P.O.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
P.O.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
boonkgang
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
boonkgang
Targets
-
-
Target
P.O.exe
-
Size
1.0MB
-
MD5
2cb582090ac253860995b7844f7872f7
-
SHA1
dd9af5c059ee15378169231bb78056994b729174
-
SHA256
c77cb990d8c1292bc7e5c26336b1c38eaab5d8534e39ba7e63b10870acaecac4
-
SHA512
16011b3034956e620a37820c537a6de13a336a1e89d57490894724fa8bb6b735e38d5b89e9570e7b39838ec3252fc31be588cf87ef54b702cd0550aad56193a2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-