General
-
Target
a6c443fd5759ca176d242c3562a85f4e5dc2fe7a44221ba3a9f9fdc0e63161ce
-
Size
780KB
-
Sample
220521-aabhcahhc9
-
MD5
4eca031c8621cf2ddcb2647d81117220
-
SHA1
46b235ab5e78eccae622c38f007ed45f02fbb676
-
SHA256
a6c443fd5759ca176d242c3562a85f4e5dc2fe7a44221ba3a9f9fdc0e63161ce
-
SHA512
cef3e9174bf4d1aaf3a872c063b6b88d0bd6bcf42d1f1ab6d345955cc8573fc34797ae329755c3c2f41dde9e479a14097be860fc8b5174a63fb12852dd4bd8fc
Static task
static1
Behavioral task
behavioral1
Sample
Scan_copy 082620pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Scan_copy 082620pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
Scan_copy 082620pdf.exe
-
Size
718KB
-
MD5
6f9fc8f70a57860061ac2d2a97fc4d7b
-
SHA1
8dfd8211abe4392682b89b86ae1956363760293c
-
SHA256
dc194ea9ab48da7308fdd284bedeb6b4651b77f47fa265e8dee1cb494681840e
-
SHA512
44e6b74e73194eaeb8afb4cd91e5c29d786b9c8a4a7fcc2dc36a755e014431bc41a17c18443eda7a4928c53a6c5c7fe466e129bde1148ac2cd69ab5d7e08e4b3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Communicating with CnC Server
suricata: ET MALWARE AgentTesla Communicating with CnC Server
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-