General
-
Target
d318c7afbf8a03285e0f3b504491b573b295d60e98a605ef4b9e1546e38a0764
-
Size
499KB
-
Sample
220520-3rk3bsccdn
-
MD5
084974cd5b022df9b8f5a07d9d84cdc0
-
SHA1
55b3b5a2ac915aa9930d5e11efcfbe36f72ec53b
-
SHA256
d318c7afbf8a03285e0f3b504491b573b295d60e98a605ef4b9e1546e38a0764
-
SHA512
ee75e3cb1a19aac07922a1ad08518ca4949dc612eeafd7d62c9034866944df8ab6b00c85ac3c134c786a60f90afff74375b9ebf5ad33150fe528f0207151e155
Static task
static1
Behavioral task
behavioral1
Sample
Payment Swift #INV0189733-pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Payment Swift #INV0189733-pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.exgold-co.tk - Port:
587 - Username:
[email protected] - Password:
001commander
Targets
-
-
Target
Payment Swift #INV0189733-pdf.exe
-
Size
674KB
-
MD5
041a15f94d91d76249e1f18726779af6
-
SHA1
a142fb148f008e8492b9068d419692884ae0167d
-
SHA256
b5092e8fd4d7a8b9649b376301ea125eb63d8a5a04360c87a8140200ff31c478
-
SHA512
7181a863c493df25c1bd874653ddc4ceb9e4ed036b8059326564ba7f1ec6f36951cde910507f5761b0d5a3448c0140ce6c30cb7720b01cfc481e9c3d4d7801e8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-