General
-
Target
acf9d18dc4a601957b6fd14f380738e5526cf6d72ab11a292a24bf87b1f65377
-
Size
385KB
-
Sample
220521-n2sslaeeb5
-
MD5
909f0dedc38926622b8479e534212fbe
-
SHA1
cf377c4fdc634fba507a5634fb224f6b78163041
-
SHA256
acf9d18dc4a601957b6fd14f380738e5526cf6d72ab11a292a24bf87b1f65377
-
SHA512
9057609bf1fa9c3a9d2782978e00639b2dca38c1528874b2e64dfd6929569ecb878a54817c2d6f38126706b71c31bb49d48c654bef03ba1afc235d950cd38644
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Order.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ametropolis.com - Port:
587 - Username:
rpalma@ametropolis.com - Password:
Gera5956
Extracted
Protocol: smtp- Host:
mail.ametropolis.com - Port:
587 - Username:
rpalma@ametropolis.com - Password:
Gera5956
Targets
-
-
Target
New Order.exe
-
Size
406KB
-
MD5
f43c53421cf9335c5ad6cf9efb6f8078
-
SHA1
d500c6f04ed80932b4b4a4800c55d943b5b01cc3
-
SHA256
0060732dcb2f0ca7f2e8866f569ae58536aa8615a612c0f0f9fa9818e49a2a4b
-
SHA512
54b5be49e2f642fecb9280aeacc670fdfa72678de0e8f604a821642f66872c9c38698316cf9e55d768a73b8088ec77b824e1f1c40a379adaf2540cb1a0a59d4e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-