General
-
Target
3d1f644e0be5bf18f97f1d8094c92fec74c1e55230eb11928d9a555ef28b77b6
-
Size
550KB
-
Sample
220521-n9hycsaafn
-
MD5
974ce1759a3872e956c1f5e190671de2
-
SHA1
96344e617170e665318eb1edfc0c94eca49ea52a
-
SHA256
3d1f644e0be5bf18f97f1d8094c92fec74c1e55230eb11928d9a555ef28b77b6
-
SHA512
1d3d4f721d70b33b13501ce90812d65a0c87c39d3c981fd9220efe7cb30a6cba0a4b080b3c24e18bc063bb508ac8373cfca6357e8d0091666c4bff30af4c1f41
Static task
static1
Behavioral task
behavioral1
Sample
Ref ____ No. 12082020 ___ Scan.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Ref ____ No. 12082020 ___ Scan.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
banks.logs@yandex.com - Password:
Swagger22
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
banks.logs@yandex.com - Password:
Swagger22
Targets
-
-
Target
Ref ____ No. 12082020 ___ Scan.exe
-
Size
688KB
-
MD5
bb22c8af05bf472b9a2574e8b82d5074
-
SHA1
0f8ab7991bc71001352f13f5ad2b8d9bdbf1df7c
-
SHA256
9f45c86fbb9fb265250eb08929d8c8cff306fe1715bcbb2e6fe5008f38903f5e
-
SHA512
841990552274176f36b54b39afce11ea6ed9a4bdec900f47d673d517860f9ec1442d294361e72963a9aeeb64e45d60e9ecd958132b3709f026362f49999fa7f0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-