General
-
Target
6b5329d03975cb323b679cab34f86c7aab8ac55a9d391dd48102cb420e3af506
-
Size
348KB
-
Sample
220520-2yecpabbfn
-
MD5
0c9ee840cb60e55d2466b097ee7235f1
-
SHA1
a5cd5380f4f4150f76fb02c5b3675d275bb999e1
-
SHA256
6b5329d03975cb323b679cab34f86c7aab8ac55a9d391dd48102cb420e3af506
-
SHA512
4106d5f5c865d7b0e9aeea2bf113f799e2fd96b6a8853071a35f18360c9c3147d0eb41d43929df22a61527c830b54842d6117f1424fad914525f80baa9ca2fd5
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
@jaffinmarknma@344
Targets
-
-
Target
RFQ.exe
-
Size
401KB
-
MD5
5e6dbf9a72d11baea82e8a72d7dc04b7
-
SHA1
8331bf45f28febf79f3318f4c8054869e4245822
-
SHA256
238788e74cb6c3236215f14bced5cfb01458fdd84a924d615f54a597db2f8f27
-
SHA512
5f5b71f36903f31517ff6284a17f067f85a59773844517a61774e218b7e2a23fceba34598e9fb8cd40594d546af71f2f5765cfab8d39b9628aadabdeeb1aee51
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-