General
-
Target
d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1
-
Size
638KB
-
Sample
220520-rt67ssbdbp
-
MD5
740ae2984b6dcab569df5530f6f52b82
-
SHA1
6bf2be703b8bd4cd244533fe44bf20632fe3a2d7
-
SHA256
d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1
-
SHA512
62ce4c2514f3a0c0a91d1204bdfa9872a902c9e045f92bf44c8517649d44af0e217ff9b168bc2c63dd088fb9fe43145694e7d3d2188d10dd12aab07c1fdb008f
Static task
static1
Behavioral task
behavioral1
Sample
Fa-200000345.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Fa-200000345.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.salsabile.com - Port:
587 - Username:
recep.mag.mp@salsabile.com - Password:
@SALSA@2015
Extracted
Protocol: smtp- Host:
mail.salsabile.com - Port:
587 - Username:
recep.mag.mp@salsabile.com - Password:
@SALSA@2015
Targets
-
-
Target
Fa-200000345.exe
-
Size
974KB
-
MD5
7789215ed9d6d730fb242791151786ea
-
SHA1
a911fb8e9f323561f202f58cb26f177a5b7eef72
-
SHA256
13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3
-
SHA512
b49cbc134c1e612b7e861e2528ea282980b9cb9a8d109cb3f9ce37b94e76565874da3d19ae88f92be2f917889909feaddad925193f69743564a6f18648586905
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-