General
-
Target
3954ebb09883298d14a3d3d9daafb022876c03f0b24d9fa5661ed82d39bfa16e
-
Size
764KB
-
Sample
220521-az22laeaeq
-
MD5
4254c500f69469006a2d2426a4412070
-
SHA1
4dc74b1532cfd0a1ced7240b6d2bd575597f0560
-
SHA256
3954ebb09883298d14a3d3d9daafb022876c03f0b24d9fa5661ed82d39bfa16e
-
SHA512
dd5b23ef7d255e180d74b71fe915aa28506e791a4064e631f26c1b1dfb083ccc15955c38be836eadbf8d150f32ce69c518fe7e1a9f0ffd2d7df9eab24aa66404
Static task
static1
Behavioral task
behavioral1
Sample
Proposal catalog.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Proposal catalog.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
gallery
Targets
-
-
Target
Proposal catalog.exe
-
Size
703KB
-
MD5
0099266be4fb71dfc25be49fb34df81a
-
SHA1
3e8580f27bcdae7564f719110d8592a030c7c25e
-
SHA256
a1ec16ea0d0f8133dfb05368d5137b6e49d90039dddabe9bb46b3bbc5278fc26
-
SHA512
8f97a6ca5e9158d73b29da4845e64794e553637d383cf700a4b293d0b34b8b88140707707830cafdfaf3359a97fcfaac19caac420aeb34950fee07d3610ce486
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-