General
-
Target
46aeb4d26e0411fabd5b6dd0f5ad00f962170a989416a11efdedc9f4134e1aca
-
Size
551KB
-
Sample
220521-axehhsdhfm
-
MD5
c29c9807e54f22e7370f9f4e4d08fdd8
-
SHA1
04a7fb009b373db8a645d4dcc0508ed700a40c2d
-
SHA256
46aeb4d26e0411fabd5b6dd0f5ad00f962170a989416a11efdedc9f4134e1aca
-
SHA512
554a6aebf7f1d3ae8a6f8c008eef514e2228526ac49d8236cc0953c1366aaaff32fa2bc0ef5236c371c914ed848907c526b114ddf6d9b1ac52ba89903428c4bd
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry Order KV200803.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Inquiry Order KV200803.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
OGOM123456
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
OGOM123456
Targets
-
-
Target
Inquiry Order KV200803.exe
-
Size
712KB
-
MD5
4d58a216c3bf2157d40121e9bb0e4c7b
-
SHA1
5603a8e2b6ab301c47a711a10fe654c587e47676
-
SHA256
5fca471621deeb28a2e5acaee925fdbaad78c20c9717ebc5b145a79393bd377e
-
SHA512
a0fdc1f1b3eef4ec23797358ed7ff7560926e192434059f43e120eee3d11a78094cf50bff7e02f77616aaeaa8b8e378988c3131f02a5b8ca38067dc87c82a5a7
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-