General
-
Target
f360c982a239c5902dc727ad78af022c1a699c3433ab721248b5765bc0d6f3a8
-
Size
670KB
-
Sample
220521-nbccxsddc6
-
MD5
417aaba9d67a730dac35f3d84e5ab2ee
-
SHA1
600dd49721db5a33ab2652b79f2533455484fa18
-
SHA256
f360c982a239c5902dc727ad78af022c1a699c3433ab721248b5765bc0d6f3a8
-
SHA512
4115cfd05d779fbcadbb7e8a16e201a6e36c7a0689e5103ddeb2e7072d22c30b2af75925deeb0fb9abdfdb64d94f7199331d10722a3307c87d618ae9914be56a
Static task
static1
Behavioral task
behavioral1
Sample
f360c982a239c5902dc727ad78af022c1a699c3433ab721248b5765bc0d6f3a8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f360c982a239c5902dc727ad78af022c1a699c3433ab721248b5765bc0d6f3a8.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cortlandfire.org - Port:
587 - Username:
matthew.vanheusen@cortlandfire.org - Password:
UsMc2336
Extracted
Protocol: smtp- Host:
mail.cortlandfire.org - Port:
587 - Username:
matthew.vanheusen@cortlandfire.org - Password:
UsMc2336
Targets
-
-
Target
f360c982a239c5902dc727ad78af022c1a699c3433ab721248b5765bc0d6f3a8
-
Size
670KB
-
MD5
417aaba9d67a730dac35f3d84e5ab2ee
-
SHA1
600dd49721db5a33ab2652b79f2533455484fa18
-
SHA256
f360c982a239c5902dc727ad78af022c1a699c3433ab721248b5765bc0d6f3a8
-
SHA512
4115cfd05d779fbcadbb7e8a16e201a6e36c7a0689e5103ddeb2e7072d22c30b2af75925deeb0fb9abdfdb64d94f7199331d10722a3307c87d618ae9914be56a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-