General
-
Target
0669e81b8d22b4d3495ddbbb9435cfb3804fcf34eb191491092a610730590e7b
-
Size
1.2MB
-
Sample
220520-2pjwtafga5
-
MD5
e4b718d2048e74a3ed700a74d92a9a10
-
SHA1
682ab984251c88bbca9dde62eab46e8a54fa293f
-
SHA256
0669e81b8d22b4d3495ddbbb9435cfb3804fcf34eb191491092a610730590e7b
-
SHA512
c24a73a6bf8d7a2d134eae09f46b766d93826ff27267c53c4b0b15538911971e6a58edd518e1bccf2c92bf43332b5e3f405873fa5ce914dc87a88de08bb6341b
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE_.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
INVOICE_.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.katholikos.net - Port:
587 - Username:
[email protected] - Password:
ZIvkTSmX4K
Extracted
Protocol: smtp- Host:
mail.katholikos.net - Port:
587 - Username:
[email protected] - Password:
ZIvkTSmX4K
Targets
-
-
Target
INVOICE_.EXE
-
Size
484KB
-
MD5
40457707e685cc64ed22fc397a44d85f
-
SHA1
777d9f5936870ca175fbe4dac6256d759c7a0721
-
SHA256
68c326087c2ed640e74b243ecfad7be9fc4e2694f80991a5337e8f91fdf4efc7
-
SHA512
f7af69757351296f4f89b643c433dc626ef1df7e6ed6814eb55e37d5c22f9881f9c90a9e2b96cb29f2bf9fd42172bcb909eb57a102e6d45833a54aa5540a08c8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-