General
-
Target
e1d86f4709fc4b8c63d79c960272eef76faa2b7f3e2568084edba6abb8a1b286
-
Size
379KB
-
Sample
220521-cegahadgb9
-
MD5
775de42d569adecc0449b5f7f52fae35
-
SHA1
359870a146d0c9bb8746a0e66c53309f8b04f349
-
SHA256
e1d86f4709fc4b8c63d79c960272eef76faa2b7f3e2568084edba6abb8a1b286
-
SHA512
2078902b789a103a157f3a3772a0649e9253b208463c75b22b15a90f41421e9d217e6268a2c539b499e3a1f415df4d13f01828431b88e075591004b7fdac8671
Static task
static1
Behavioral task
behavioral1
Sample
Court order_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Court order_pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.elittacop.com - Port:
587 - Username:
[email protected] - Password:
@eaSYuc8
Targets
-
-
Target
Court order_pdf.exe
-
Size
546KB
-
MD5
da020d0c54734d21d96efd3b05cafc0b
-
SHA1
1ef4a1601984ed3eeffcaa15ecaec7ded28f7ebd
-
SHA256
0a8a4c3e09dd9ea5652a1388c395ed0707e6e2c370fa0fa288f71da425022464
-
SHA512
233816b405f65db45ef67ddac66e16746d341ebd53c6ab289f5ef19ded128eb82631cf2f6a9593771a71bdf564a2c667b4088cba43524c480ce6ba6ad2c352b9
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-