General
-
Target
bbb48f0541091fabaffe3d901841a0d929e2d91b1575d926a63b811d3a614152
-
Size
418KB
-
Sample
220521-cn8fcahcdr
-
MD5
9fe60287423ff2cbada2bd264f86db63
-
SHA1
dd23917635b23717e77b10d36b24bd8260958644
-
SHA256
bbb48f0541091fabaffe3d901841a0d929e2d91b1575d926a63b811d3a614152
-
SHA512
379d5c0f98ff71c5136e281604f4c8b128a3db8371f14e9fa05d45d479d8b89ca005218dbb81f3b6ccd20991cf3d036ac0b11a63bf79eb0529c4ccb3d8d5f2fd
Static task
static1
Behavioral task
behavioral1
Sample
IMG 24344 NEW ORDER_PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
IMG 24344 NEW ORDER_PDF.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.candenizcilik.com - Port:
587 - Username:
[email protected] - Password:
519025
Targets
-
-
Target
IMG 24344 NEW ORDER_PDF.exe
-
Size
522KB
-
MD5
738cc68cbed4ce5180c71952b86acbfe
-
SHA1
1690297c53df2847bef42b5bef74c2afab4204eb
-
SHA256
64f1939cbe2828095ccb96973565bebe5a2cbf3baf78aaadd2492eb654415264
-
SHA512
4951c829a08aa07619bda202a4a5e48d3f3d16f33806e1c92b7e66c3488243f13817875ef4c9fd9bdd13bbed068824afa54154351208ba00c056604952f45368
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-