General
-
Target
767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc
-
Size
501KB
-
Sample
220521-nbv52agedn
-
MD5
48c593035eb4517cd4378fa12a44ad71
-
SHA1
44bcb343126ccaf63198584ca15fa141987739e6
-
SHA256
767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc
-
SHA512
4ad3c6037adc29bbe6e760cea5ee574a499037461d4c917fb8e0711032ae4c57729fd9cf8a3b6c3e0c24d4b6b4031337596ac305497f1e66fdccb9e675bdecf8
Static task
static1
Behavioral task
behavioral1
Sample
p9Xgnuhx4tNRjsE.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
p9Xgnuhx4tNRjsE.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Targets
-
-
Target
p9Xgnuhx4tNRjsE.exe
-
Size
586KB
-
MD5
a2415c6836e64fc1c9ed53febcff620e
-
SHA1
acf8390606054575f9a54084450c2d1230b38828
-
SHA256
a52df6fbfa534f162855c39194591cbafef749a4c24a0d3c1dc80c1125453f26
-
SHA512
8beb57049b29efa079ba5fd2923a53fcef773647483da12f0662b0788248ef97cb9b3e3cc3bbc21832c8ac3abef3d749500598f681e7c2377a57368a7cb001f0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-