General
-
Target
5ce8c4d2e12543d6c237e1f98c76c6daff01b3e477c40e5abeea39afb7327da0
-
Size
1.6MB
-
Sample
220521-arwjvadfcl
-
MD5
080e4d79d6178bdc12ab39a8fac1a75f
-
SHA1
741102a6813d1561292a8169e1f0dad030db2fc0
-
SHA256
5ce8c4d2e12543d6c237e1f98c76c6daff01b3e477c40e5abeea39afb7327da0
-
SHA512
0387cc9e0e1c55a5ee332f4344c6df3cc3be0a7cc0e9e659567f9c74425043837ecfc44a2e3e655f8d7405ddf00eed644afc93a729e52f9dd467950978dd0cc4
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFER.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TRANSFER.scr
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.northwestpowdercoating.co.uk - Port:
587 - Username:
[email protected] - Password:
C^0z.^LxykTW
Targets
-
-
Target
TRANSFER.SCR
-
Size
1.1MB
-
MD5
b3af901e962e7693a2be0ffd2c360538
-
SHA1
6669cd006c13bbf3927063ffe5701bad1b698c3f
-
SHA256
392faa37063ee6a619a3091d1d7a27b8c0d86d35a7f1594720822f8a94ce9d1b
-
SHA512
6976f08cb58d80cb8f819aa105fc2af0f00059d839e8fa9348a8ffd95ccac6a42ad298f500e0a5aafe7c10605080d67ffb260a678d81c0416095461d1d5f5b6f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-