General
-
Target
40aeb86661e9a93008f1e923734b56e2d508cfb540767373851c34da536b87a0
-
Size
503KB
-
Sample
220521-ayngtabab9
-
MD5
74fb83413e805be8a2328e0b20056d7f
-
SHA1
3b20e95abe24fa3d88b32ba165eb22b3f667d909
-
SHA256
40aeb86661e9a93008f1e923734b56e2d508cfb540767373851c34da536b87a0
-
SHA512
26327ed9e9a5d45cc95977e7a398aad22e6d50e9386b98c800f7d2d891b4cba697d52fe46a3d1811c142c7c5dd5fbd136bbdd7d66cfcb364688b323c704944be
Static task
static1
Behavioral task
behavioral1
Sample
Amount 30,000 EUR.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Amount 30,000 EUR.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cybix.in - Port:
587 - Username:
[email protected] - Password:
cybix@16july
Targets
-
-
Target
Amount 30,000 EUR.exe
-
Size
615KB
-
MD5
6f5cc8fa4d270a910af4fe1a3200f8fa
-
SHA1
b5b4fe3824f4baf08d0bf7e19bd4f73589d4b305
-
SHA256
92937f7868601189fc7a3c51f7de21a1a16d92d2ec823cc6faf69cebc8939376
-
SHA512
b8dcede8e0506a5feab87319d345c471f3aa14fffb0c70cd94737f9147b5d6ad27dc9dce356067fef23184c5c9eacddfe9d91f5ecd0936ccf83ff92a714aa911
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-