General
-
Target
485885e7fb7acedf7725c4c06222e7863207f5d99167348febc9b7a182413858
-
Size
415KB
-
Sample
220521-awz3tsahd3
-
MD5
22a0a36ceed1fc2165b7b0eaf99889f6
-
SHA1
e41d32073ad3eaefbb7691557c8d0c677a428715
-
SHA256
485885e7fb7acedf7725c4c06222e7863207f5d99167348febc9b7a182413858
-
SHA512
eaba44c4e389a617a9869013a5f45d303b8aa87e27f62fd37f30f0f3a18105065bd7e6fa3b4a84947655fe53f0014b38f512744a95abcfe4351102ebf9d818da
Static task
static1
Behavioral task
behavioral1
Sample
MVHEILAN_INVpdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MVHEILAN_INVpdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
secure231.servconfig.com - Port:
587 - Username:
[email protected] - Password:
eltaefSH6548883
Extracted
Protocol: smtp- Host:
secure231.servconfig.com - Port:
587 - Username:
[email protected] - Password:
eltaefSH6548883
Targets
-
-
Target
MVHEILAN_INVpdf.exe
-
Size
592KB
-
MD5
d07b3844baa07c57e8ef119ea1c29e85
-
SHA1
0601eafdf5b9550b940a1255a28af2c5b4447eca
-
SHA256
a8602955f5fdfafa21aebee64feb294b68d8e7b85997992c560f769329e7043f
-
SHA512
4ea35d4591b4e205b17336ece22e99e0a0b603c0c38984f41ed2a0f417d2886ebe8aad52b1554bb9707ba94f3aeab44f10fb631f4cda52c683954e80b973fa95
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-