General
-
Target
e8b8baa520eea96ff64604e734d7fcbdbb761eed654f9ef2964a9203c5fd7b86
-
Size
447KB
-
Sample
220521-cctstagffq
-
MD5
b287960251b5a4c3001e233ff40dffd7
-
SHA1
d93229fea4eef23d1885dcf636212d8e35979a58
-
SHA256
e8b8baa520eea96ff64604e734d7fcbdbb761eed654f9ef2964a9203c5fd7b86
-
SHA512
71d0e13bef30112e945189477d2f86d6082c903b2e888fad352698f948e60536cece3a0561f533d4c6ae8bc9640d9db6d34873db76496fec113496aaccfc6e00
Static task
static1
Behavioral task
behavioral1
Sample
P.O 20A00827.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
P.O 20A00827.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
r112ds144.redewt.net - Port:
587 - Username:
[email protected] - Password:
Inbiz@facturacao_1357
Extracted
Protocol: smtp- Host:
r112ds144.redewt.net - Port:
587 - Username:
[email protected] - Password:
Inbiz@facturacao_1357
Targets
-
-
Target
P.O 20A00827.exe
-
Size
523KB
-
MD5
899fba96547d14cf0100b57a6cf8f9fd
-
SHA1
1b512803f901a907d2a19e644c943fe8af09a80d
-
SHA256
a1021556aef2e3dad9d256ffd84999019982f77bea0e32e7428a18f666fd7d12
-
SHA512
195069e2a36045167c53d541bee660385f1e73b30ced9b1d9b216823b8e2155352b31d426f304ae15916fca0818df52f8fb984634f4820a94a880fb9cea17b1f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-