General
-
Target
b065429c385c4b9a61f28c2797dfff2d70cf21dd5baea137942b17bc13ebe945
-
Size
362KB
-
Sample
220521-crz85shdfr
-
MD5
3b7cfe8409b49a85f1d2c406953177ac
-
SHA1
8dddc2134f0030fd881ba41e2ec92c2c350c8d45
-
SHA256
b065429c385c4b9a61f28c2797dfff2d70cf21dd5baea137942b17bc13ebe945
-
SHA512
0d26b56451c2752ea2453e9279e85694d3c9f4b025a3c54ed496b961c002242e8a164dcbbaa97254bfcd87119915156b707ee7b1da4928872147c853439bdeab
Static task
static1
Behavioral task
behavioral1
Sample
proponet.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
proponet.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
1xH}wgu7}f%E
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
1xH}wgu7}f%E
Targets
-
-
Target
proponet.exe
-
Size
394KB
-
MD5
77fd5a13e3c1bf9e75dbea2453bbe9dc
-
SHA1
9bcf0ca9cc19140141d243d1a6ebb57a01da5d58
-
SHA256
e4a95445ff5dddd4211458a130f22eef7295501a4d3bab11b9f13a4f1c689eb1
-
SHA512
187ee0d48df7bf6517f2064521655958979707da12a7f7fb81d5a7c918050185a7442edefa4ab05cdd2a5c1b858021fa4e22f31501e91a2a68c0bb909e21cc4f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-