General
-
Target
86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64
-
Size
4.2MB
-
Sample
220521-n42hhshgdn
-
MD5
0dbba83f86435ae8f84e4e9fb8781b53
-
SHA1
78e8b4640956643418de07a96dd6f3f5dcb7ca26
-
SHA256
86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64
-
SHA512
3dc5cecdbbcfa32f8ac21cf2feb53a17e1802871faeceab6cbaefe455bedeae9790c5df096f371c4edbb1c40cef5570263ba140037faee0a6e6d7d5d75412830
Static task
static1
Behavioral task
behavioral1
Sample
Doc#162020094753525765344650094480.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Doc#162020094753525765344650094480.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
chizzy25@
Targets
-
-
Target
Doc#162020094753525765344650094480.pdf.exe
-
Size
4.7MB
-
MD5
ffceee8b1fe197a9cac46ae74a66bccd
-
SHA1
806284efb14a8a27f44eee9564957659eec05282
-
SHA256
5bf9c6dd99a8c7ee59efcf09ff2b4ee5b5f51aab9ad91cd2aa0fca4b0ae975ba
-
SHA512
9d1cb0248107409eac2def450ebc99173e67340ee79a6f62c9b8273e318b0c17b53f914f122bb79d02f55af86516852100996c5152b5e15917a6c490c53e7627
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-