General
-
Target
7db205b01e91b3f3c9feb8b92ecb402197cc3128ca2fea00cf890f6d7cd59721
-
Size
391KB
-
Sample
220521-c5ybpsfae2
-
MD5
23badceb48cd68a21da562a921975970
-
SHA1
1fc175fb9c549505fa2df3c54dfaf2da1edcf688
-
SHA256
7db205b01e91b3f3c9feb8b92ecb402197cc3128ca2fea00cf890f6d7cd59721
-
SHA512
2c27a0eadfed8c16e56f19e79cb545fb73a4ac2ae347550ca3136d8c4fb570824c1f6d3139d9ee1d6f3427fe9cbf10e11e1913288b64a99bf18a4d1d663ffbb1
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCS _234372.PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SHIPPING DOCS _234372.PDF.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.microtechlab.in - Port:
587 - Username:
[email protected] - Password:
pune@123
Targets
-
-
Target
SHIPPING DOCS _234372.PDF.exe
-
Size
424KB
-
MD5
f0b3e2a7cef0d4e0c6e094676550221a
-
SHA1
fc8cddcf6526cd3ee94141b6299c7069ad1b19b0
-
SHA256
6ae9b8c271b5110c7cceb8b7d39522dd8d444dddcfa3691726ff3580562a73b7
-
SHA512
3a0f6d6e979871ecdf4cce66e63674ecd32568f0d45f91448b0bb986fccbbf3173734f992d6c0add58c5437fd048e36c4b00bd8efcbcf5c161b35b8c7e26178a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-