General
-
Target
24ebd06b07f1c9a22aaa2212d7a883ac692f0581f85ae3ec5617856ddb1d280a
-
Size
1.2MB
-
Sample
220521-bxd3escfb9
-
MD5
5323b37953a5ba7674193cded94e37ac
-
SHA1
668fd1c977defe8763a8de9aac5ebfb46b81562e
-
SHA256
24ebd06b07f1c9a22aaa2212d7a883ac692f0581f85ae3ec5617856ddb1d280a
-
SHA512
905fec205b9f71cb847addb5fc6d33279c723c20f3bc1e7f39b33bfbe7e8abb95f9214d2a2d9bc8da4ccc75a7501f7a2052e3f562554be08dfec8c24489e7cc2
Static task
static1
Behavioral task
behavioral1
Sample
SRUYM9J4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SRUYM9J4.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
coronavirus2020
Targets
-
-
Target
SRUYM9J4.EXE
-
Size
475KB
-
MD5
5fc1b1f7d19c60e9776c53deab129960
-
SHA1
655038400c51c6e137206f79fb9995b432665f93
-
SHA256
1fc23a174b140e18c483571695a84360667aa1c719451bba5c73a4ffe4da48d2
-
SHA512
2090df70e0073b04a93407e6f00ca235425a8d1076c12f7bfb2766e7da103d23600539015f47d7075c995add45accbfc15a18415be4a99e1a43a448e23af8a6d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-