General
-
Target
81d0730521f732210b333936704cb428748682e7e759df0ca3270af0acb98ecf
-
Size
500KB
-
Sample
220521-ajgqqadbhp
-
MD5
5c6520d0fce5c6bffae180afd67c89ea
-
SHA1
889cc40d3c473b7a1ee05d28f9eed883369e0a1f
-
SHA256
81d0730521f732210b333936704cb428748682e7e759df0ca3270af0acb98ecf
-
SHA512
b8480c9f762fd9287bdcd1f60acc5fe3c0360236252661cad8b55e6cc2fbeedf884be2ad71cb4e0ded63fdeda665d935a61048cd13e726cb9bc28d1f4fdb00f3
Static task
static1
Behavioral task
behavioral1
Sample
INV#1191189.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
INV#1191189.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
bigboy5570@@@@
Targets
-
-
Target
INV#1191189.exe
-
Size
756KB
-
MD5
1604fe8db7ba94b1a2481f7be905678d
-
SHA1
fe0574f94fa17b516944d907ce56512d9b8fe7cb
-
SHA256
8cf9af45d6f115b18b87b22276c82d085f13483fa501e927e613098a62cfd307
-
SHA512
bea44b701d50e06b33a9a354bf6f4027a53cc3d942a23e21a9c3d1fe5323e877ffa14a257c0522b550ceab9d24ed81259f3cee43bbaf0802c6b50eb400bedc9a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-