General
-
Target
4c3f9d5742b481f22de9aba54be918f1f4f6c91aa7ab62f5e37e18d0e4882c93
-
Size
419KB
-
Sample
220521-av7fhsaha6
-
MD5
2dd8bf1310929739e233db24723387ed
-
SHA1
f7b1a91970ea08e97cb848afe3c8a1b827cc78ad
-
SHA256
4c3f9d5742b481f22de9aba54be918f1f4f6c91aa7ab62f5e37e18d0e4882c93
-
SHA512
a13eae6066edd178a7c5f9022594a27869e29f35454d38a87a19cbee62e9829e5edaaf9911a842b6844559ab5d205cc0c2fcc63133ff40b064bdc2fdfc971eca
Static task
static1
Behavioral task
behavioral1
Sample
PO#6474 (2).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO#6474 (2).exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.greenslr.com - Port:
587 - Username:
[email protected] - Password:
)HdurgF2
Targets
-
-
Target
PO#6474 (2).exe
-
Size
607KB
-
MD5
26e0bede36c40dd7bb6b3c0cf3c73489
-
SHA1
29c72303876b117c10cca1cd199b3eb6ef3c99e1
-
SHA256
cd4f2162b438b601e0416d30cd5dfc0d00834690a1300f53f294fb58d6d6264a
-
SHA512
3c0b08d017c64c7eade6cec78e89934b856d4b977316b4b8d2f77e1f1fc55d6ae5b9757ed438ef5490980527542ae9beeca303b488176541783dbc9b9c566866
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-