General
-
Target
18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4
-
Size
364KB
-
Sample
220521-bx2hqacfd8
-
MD5
e5871025eed1e3d02b73fc5acbf2cf46
-
SHA1
92d740db16d0cc0c4bbafbfaf858ddec31199199
-
SHA256
18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4
-
SHA512
51e0a7ac4143168b7ef6fa089572bb5973a9a34a08cea7bc39fd4022626d4edef5dfd6cf3452202061c4c1c0bfb7baa7a774cbaf4a28d414a444e7c3c6602175
Static task
static1
Behavioral task
behavioral1
Sample
PROFILE.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PROFILE.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
OneDay@time
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
OneDay@time
Targets
-
-
Target
PROFILE.exe
-
Size
453KB
-
MD5
0730a8b1cadc7b07bd0a7fbe57437939
-
SHA1
424eea095b6b46cc0d3d6812b85230308b672ce7
-
SHA256
ceb7dc735aad69ceaa69d7353b2364bbaf2ccd69176707bdc0d7c38f27e326b4
-
SHA512
563f6e6e58938730f68af98b0fdc7e7f079ff85222a4db9270bbc5ddf2a4f6ae607fdd271048443b0d9c5a48ba5c53e0928d515437a10d715a7d7deef9b98bec
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-