General
-
Target
4a991fa33f29606bb570b16d94a973f3f1185c9588c2aa3a2957069c6faacb7e
-
Size
301KB
-
Sample
220521-n8pdraaabm
-
MD5
66b708101eba610a3ba93181d9d5699f
-
SHA1
ae2e8e61b33d1064ddd6c302460032f897ed4a3a
-
SHA256
4a991fa33f29606bb570b16d94a973f3f1185c9588c2aa3a2957069c6faacb7e
-
SHA512
bc5d34c2c399f2ac118a1d1209b3220d87ae825db31f8d44447e661a41fa3fef92e906750f4822e1400fbbfcb68de0ec25fcdd2a924311221c836ca4a91645cc
Static task
static1
Behavioral task
behavioral1
Sample
Order No. 48000073625================================.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order No. 48000073625================================.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.bnb-spa.com - Port:
587 - Username:
inform@bnb-spa.com - Password:
}iPxp@l#21aE
Targets
-
-
Target
Order No. 48000073625================================.exe
-
Size
344KB
-
MD5
28ff3fbc57e6b96adeb90b7fc48eb5e8
-
SHA1
5cad4008370c910957e30afd8b2ac021963e5612
-
SHA256
0a2b50c51276d02866449d9efc41787d3b4a207675c75986ae3a790c1bd8c490
-
SHA512
9038139d3dcce3001ba2955958a236ce06a1b69fb4388f8ea98b1ded5f65c4daae47d039e27d0504fc3e90be0aa981b25748edada0f8a5147a97a476fc3ba284
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-