General
-
Target
833142c3f080c11abc2686a68c02e320640524bc0023b909f6bbed03454d8f28
-
Size
492KB
-
Sample
220521-c4kzzsehh6
-
MD5
a5f4dec59213313cdcec45bddfa2866a
-
SHA1
8746861f834c06240f7000f7445abce0f8ebde87
-
SHA256
833142c3f080c11abc2686a68c02e320640524bc0023b909f6bbed03454d8f28
-
SHA512
28d8a32d1008e0c9cfee28489746e4d86ee4e39e97a5075733b8e6e353873d02c398db3d29dcf523f8b317f25550d038e393ef88895edf4090269673471e5af0
Static task
static1
Behavioral task
behavioral1
Sample
invoice # 16789875.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
invoice # 16789875.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cybix.in - Port:
587 - Username:
[email protected] - Password:
cybix@16july
Extracted
Protocol: smtp- Host:
mail.cybix.in - Port:
587 - Username:
[email protected] - Password:
cybix@16july
Targets
-
-
Target
invoice # 16789875.exe
-
Size
684KB
-
MD5
5516d1bd97dfd0137923b20743a788df
-
SHA1
eda2ab31dd47df3293b8f32f4fa04791c4d62166
-
SHA256
006f386e351c4831487c86649a03329e62c3cdcd4a468b55bcf3f140b56deb8a
-
SHA512
b96abad3b19ceba420ab745edbb54610a02be4daf33d9ca530831b72e8769e544789d030f018c2dabec8dab5f5195ce69ac55682dd583fa02dade810c48fd42c
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-