General
-
Target
50ecd762337c970aeb98ed3c29827b72235ff69d3eff290c77cf44a80752151b
-
Size
496KB
-
Sample
220521-dh3tcafgb9
-
MD5
e25e1bd64bc8224dfc9a643ce6888bbc
-
SHA1
f3949c02e32b819a3464ee85141710daa57a7cb6
-
SHA256
50ecd762337c970aeb98ed3c29827b72235ff69d3eff290c77cf44a80752151b
-
SHA512
af67a5e693cf93026e78ada0768e909974946d7fafb79760691062314e6081d9a9e22534c6bda88ca2ae7781779c172c7be64c3746f627e246e5cd33821b5e68
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Copy.PDF.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Payment_Copy.PDF.scr
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
killdemall007
Targets
-
-
Target
Payment_Copy.PDF.scr
-
Size
603KB
-
MD5
6f4ff4d406d6917c9261333ed9bbc58c
-
SHA1
9ab4630d7a4323ab119535990b008130890d178c
-
SHA256
190be18ceb220a947bf797e07e27b41987d707f00ce1774e05998a6682482f43
-
SHA512
7a388d5f6fd968fac1cd31f4c48b7eaa140986bab705c1694c2390072eda4995095ee2ead609c4e995a92c3913c6a3eb22205db80998ab12b8dfb9c6a22afd12
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-