General
-
Target
f638b6b5261b1bca1368c299b7b7017360192e19058da4f5079cfb342d0afb63
-
Size
1.4MB
-
Sample
220521-blws4acah5
-
MD5
8aff0ad071fa957af4b4340c067f7320
-
SHA1
874d822aafb45ae6d967e8d19fc826ad79bad9bf
-
SHA256
f638b6b5261b1bca1368c299b7b7017360192e19058da4f5079cfb342d0afb63
-
SHA512
1382eca63998d5ba5f676b84e349185468e21cc0dc0a601d08610516a16da3a315c5e370125bed1391a3c9a6314e6a60b837405de08cf9ea10b53143c5c6a2ec
Static task
static1
Behavioral task
behavioral1
Sample
EFS_SPEC.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
EFS_SPEC.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
business43.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
P04042017
Targets
-
-
Target
EFS_SPEC.EXE
-
Size
845KB
-
MD5
d51d2bf57db9ce6c54521c328dd5fb28
-
SHA1
674964135e6b5d1a766240ebd0340a4db0064218
-
SHA256
cd9b154f848a6f37a110de136034cbf5190600da5687bb6259f19addf2e2759a
-
SHA512
04be3bb5ae07685b17394c3a322bde994900670b60983e7ead30dbfd7bc9cfec42b81d6c85890be52e618aa74afafc172dbbbfe19b01cc1cd6a4005907825dda
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-