General
-
Target
2b96a8e4b300395370ead750ded41da3a8ae6d546e284a87440ea870de86186b
-
Size
479KB
-
Sample
220521-n7j3mshhfk
-
MD5
dcd2763be50611d83c63d53db30158e0
-
SHA1
81702e1fb3c9f94c913112c562ae9e5f4d6e2e71
-
SHA256
2b96a8e4b300395370ead750ded41da3a8ae6d546e284a87440ea870de86186b
-
SHA512
1bf68274e436b6dfedfcd04640cb72145abe7db232bc6a7c9115c52f64f9b40bbe08a1d23747429e5662cb3b3cb2a925570fe31f58670915109dd73cc13a3c78
Behavioral task
behavioral1
Sample
TBL PAYMENT COPY.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TBL PAYMENT COPY.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
billions@cairoways.me - Password:
Whyworry90#
Targets
-
-
Target
TBL PAYMENT COPY.exe
-
Size
527KB
-
MD5
6379567925c7097a49aa88e9b0981f95
-
SHA1
ffb42a0da0e7855ecc339abb944f79e3597e6bd2
-
SHA256
10b2155331d3b0c7934808e52084c3911f82ece51f39836e3ef0e8db39ee9904
-
SHA512
c0b45c606cadd64144a9a0b8722582a045c7d3a358769e896b6d9245cfe3ee92bc7daab5d4459f3815bc12fc0e57d3582686cbb3dc73777e33f25f9396163c4f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
Contains SnakeBOT related strings
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-