General
-
Target
b81d025cefcb2d4eca4ff307fc9aa27e4e28854225a7604bc56a596da3818b6a
-
Size
416KB
-
Sample
220520-2wmahsbahp
-
MD5
f4d75d59c4b85fcc54e2d5bdec13644d
-
SHA1
e5c05c32175ca4d9c5f100171e404f516daa9684
-
SHA256
b81d025cefcb2d4eca4ff307fc9aa27e4e28854225a7604bc56a596da3818b6a
-
SHA512
30031425b0f62930b445f4c318ca31eec1d5d80158ed6ef229e43ab89a02c2eb2d22bfca54eeace87ff627a4e9caa08ea0963901504ea135e1c418cdcbbf2794
Static task
static1
Behavioral task
behavioral1
Sample
purchase order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
purchase order.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pierreinsurancebrokers.com - Port:
587 - Username:
[email protected] - Password:
advisor@1234
Extracted
Protocol: smtp- Host:
mail.pierreinsurancebrokers.com - Port:
587 - Username:
[email protected] - Password:
advisor@1234
Targets
-
-
Target
purchase order.exe
-
Size
482KB
-
MD5
cc8dd999e2986f15641dfad4362cf2a7
-
SHA1
abeb848ddcfba06a03ba90f4c55e28c56e47494c
-
SHA256
b6eecf6385766748acdbd8b0b350d9344f775495a0ca62a1dcca578d2b6100ca
-
SHA512
e43349ee45e8bed299a1cdbd0485f454f3c2dcc4f795e788541dc47860dda859584d34baef4306f4140783f9f39b6e6cb6f42da47e99428168511a0d59c147c0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-