General
-
Target
5b705363e5d6ef9a68e00092fce27d8732526c3465f725dbf72f7013998d3c46
-
Size
485KB
-
Sample
220520-3fagfsbgaq
-
MD5
e8ba37c60e1ba85626fe35b625c8918d
-
SHA1
a5d711576b6bd99ab5a88b73d33d2465f52c1ddb
-
SHA256
5b705363e5d6ef9a68e00092fce27d8732526c3465f725dbf72f7013998d3c46
-
SHA512
7b87282036d796db6635fef461331ac0811bedf2abdfb414f4fcb86186352c2d5c4e2116248fc0ffe08dc0e009d567bc8e2a59ae080c12febbacde48cb49b1e4
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice.iso.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Proforma Invoice.iso.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.opporajasthan.in - Port:
587 - Username:
[email protected] - Password:
Systems@1234
Targets
-
-
Target
Proforma Invoice.iso.exe
-
Size
689KB
-
MD5
ad3a4bbcd5d732b465ae4b36c3178e60
-
SHA1
42660b494eb45ca2b4b7eee0ddf04b4d2fe646b3
-
SHA256
af9aee5b4234182ecb5acef175f3bcc12348954fd875e4a4eccf005427525e7f
-
SHA512
eef25a97cd1eceee0db2549e95f3dd72871d14073349d0afbea3f95e7bda93de9370cf53078d02fadf6f1f546895ca8b172e50912af7b51968e8a21d980cc8e5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-