General
-
Target
5979d11d335b4bed595bcff0cac6f729febd9720fc014466437e90dd51238bae
-
Size
343KB
-
Sample
220520-2yxh9sgcb9
-
MD5
f15bacec6ca7459b6ada5040684d28aa
-
SHA1
87a1f0590f84632e4e529686173b49d214d3b606
-
SHA256
5979d11d335b4bed595bcff0cac6f729febd9720fc014466437e90dd51238bae
-
SHA512
581546315a882d6e05404108bc9e1d74cbffbcfb1fac307663440e56124c734df65d26aa1763751876a495702527074c2f64baa78f95b0bee68e921fd8e68d9c
Static task
static1
Behavioral task
behavioral1
Sample
shipment documents.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
shipment documents.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.sankapatrol.com - Port:
587 - Username:
[email protected] - Password:
OFFICE@2020
Targets
-
-
Target
shipment documents.exe
-
Size
370KB
-
MD5
4f267c8f0648a52ff6b06816e724949a
-
SHA1
5f127ece1dcc7fa1d94dd3328bb8e368bd470628
-
SHA256
d9351ce503256f14f917a5cb7adfcdcf07a9364973fc324dc9517d407c6bdd0a
-
SHA512
fd528d37848a1fdff3a92aa44441b3445fc1b7f12ad41dc01f4d4c74dd2bb21d5bfa2f03377d9942918cf3f2bf1ca7421beb7e2557a8f5fbc21836cb9a99ece1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-