General
-
Target
f53448d68d4ed895231343d65065c4a82aa91b464f45ec051cbb15fb5ba1bf06
-
Size
425KB
-
Sample
220521-b9w4rsddh7
-
MD5
4d609c15ac6b9e8a7a73964b60dd0530
-
SHA1
43692c3b6dac79d7d790addafb599dcfe7c6c6f7
-
SHA256
f53448d68d4ed895231343d65065c4a82aa91b464f45ec051cbb15fb5ba1bf06
-
SHA512
0363d5bafbe0e290199cebef9021dc1058d9b2c08aa9d22b55e3b6fc11dc0ef69829b6f30a107936a3fc3a3c22813a25aef5fde7a138fabc05ffc60d0ab61c17
Static task
static1
Behavioral task
behavioral1
Sample
PO 867665#.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO 867665#.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.fakly-cambodia.com - Port:
587 - Username:
[email protected] - Password:
Mmhh#2014
Extracted
Protocol: smtp- Host:
mail.fakly-cambodia.com - Port:
587 - Username:
[email protected] - Password:
Mmhh#2014
Targets
-
-
Target
PO 867665#.exe
-
Size
480KB
-
MD5
c42a24e45966ba0b198b8b6bf35c6cc1
-
SHA1
4af5d0d30c9cbd2a1409453f22f62aeddaab2705
-
SHA256
5b1b8f25badc68e5ea51912e4d56c879a1a2e9ba3743c87a5c31843bb0ab099f
-
SHA512
79005a949dceef1f1796a42b1ef33451d582fcf6068d8ed17d61dd9a203bab2a1578e348a631513b11452d95830c0b9d3c370a0875564834d4464fc94171c0a5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-