General
-
Target
6e22b4186cb5320e452340ec8ad72f935e7140c85608722b623f6fdfd556d0b5
-
Size
656KB
-
Sample
220521-anef6addfr
-
MD5
de7320d07d572d198ada45215020bbd6
-
SHA1
8bec855b7aa7ee91e3d2cc93edb2e22fd5308ee2
-
SHA256
6e22b4186cb5320e452340ec8ad72f935e7140c85608722b623f6fdfd556d0b5
-
SHA512
54d98ebbfddc5f6de4eb256e79791b5ac24e099c1bc9568d9fb8c802841a79bc05c32fbe9cbcd5cca568627eb877b282afa7b3bc529c7b41844ba416d7b6f3e6
Static task
static1
Behavioral task
behavioral1
Sample
SPECIFICATIONS AND 3D DRAWING P.ORDER.bat.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SPECIFICATIONS AND 3D DRAWING P.ORDER.bat.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Chinedu2@
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Chinedu2@
Targets
-
-
Target
SPECIFICATIONS AND 3D DRAWING P.ORDER.bat.exe
-
Size
903KB
-
MD5
1b96a95d241eff57fbc9b0d0eca5a4f7
-
SHA1
eeb0119eb00d6fe0ea3ddbe6355c8fff060d90b4
-
SHA256
88c038e049a04957586fb84da764a6f75e6707a1fb314a7bf4a07dd6d230b572
-
SHA512
0d4800f4ad24150fd73ccdc4d96348f280df0e338a53aa1a356120a2b88f78ffb92527b6749412fe6f5bee89b1e57a044e5f9023b339de6169a9922aeb133965
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-