General
-
Target
3c14bbb5d99a5972009eb55b1b5d6362b78079b79804c0a7d41539412cfa285d
-
Size
489KB
-
Sample
220521-nb43yageen
-
MD5
787619c63949f161862a54ce1b857b6e
-
SHA1
580349d79c5e7a572de0c161d7e075c8e968b439
-
SHA256
3c14bbb5d99a5972009eb55b1b5d6362b78079b79804c0a7d41539412cfa285d
-
SHA512
7b14e579f8d4aed1043a2965887a72b31ef7c7ac9e053bcab1c00b63c95732609f2be1242fdb197128530f700b073ce9ac6aa74a66d056c0b82726ec9a99b7c9
Static task
static1
Behavioral task
behavioral1
Sample
New Tender 32-29-1441.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Tender 32-29-1441.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.alandalustobacco.com - Port:
587 - Username:
nabih.alashi@alandalustobacco.com - Password:
xyz@zxy#869
Extracted
Protocol: smtp- Host:
mail.alandalustobacco.com - Port:
587 - Username:
nabih.alashi@alandalustobacco.com - Password:
xyz@zxy#869
Targets
-
-
Target
New Tender 32-29-1441.exe
-
Size
577KB
-
MD5
a854eabc289d75feb27d211af792b723
-
SHA1
e6ba5c03277c8a1a391f8b44635f1dfcc4f318e9
-
SHA256
04c0c3bea2ad1e7842851e2a2cd3f5598cb6ee8c509e532ed911ec82f37e6fd9
-
SHA512
67918caef0a7a8559b748d697386cb38935a3e0492d5bfeeffe570ab8e5a806824d702f0d16bebf821189f8cefc3a2d6b43ed182562e23c2ab6a880e5f6e4c43
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-