General
-
Target
8bd003e235f48ada739ae1e8a100ead019c9a268a00a0c04e54f2479ae239cdc
-
Size
496KB
-
Sample
220521-c2ep7aeha3
-
MD5
a96841e3dab638c10dbee9d4f2f10952
-
SHA1
b4affc581df6d393fdcaa865d4e1663a4d91155a
-
SHA256
8bd003e235f48ada739ae1e8a100ead019c9a268a00a0c04e54f2479ae239cdc
-
SHA512
d44f8b6721cbc9a2c58d0f745db7aca48cbca304bed5749100ba279347df3d795ac8e7e7b646a3808bb7a1e447d3fd72252091aa51ff799cd30cd6a60846c593
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Copy.PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Payment_Copy.PDF.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
killdemall007
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
killdemall007
Targets
-
-
Target
Payment_Copy.PDF.exe
-
Size
603KB
-
MD5
6f4ff4d406d6917c9261333ed9bbc58c
-
SHA1
9ab4630d7a4323ab119535990b008130890d178c
-
SHA256
190be18ceb220a947bf797e07e27b41987d707f00ce1774e05998a6682482f43
-
SHA512
7a388d5f6fd968fac1cd31f4c48b7eaa140986bab705c1694c2390072eda4995095ee2ead609c4e995a92c3913c6a3eb22205db80998ab12b8dfb9c6a22afd12
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-