General
-
Target
ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc
-
Size
424KB
-
Sample
220521-nc9d2sdeb5
-
MD5
999ca1102c1ea692e6f1e2040ba5e10b
-
SHA1
c0d56ab40c2332bd14c55bd39d36d5346146733f
-
SHA256
ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc
-
SHA512
8fb462ecdc576ebd8c2cc22555f5af60ad6a256bca1c2ae0be34d81b2bb7bde3e3daba88773649fe392d4db537170564ac0e396261f23bfda1f2cecfabe02e0d
Static task
static1
Behavioral task
behavioral1
Sample
1332000.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1332000.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.tolipgoldenplaza.com - Port:
587 - Username:
[email protected] - Password:
Golden@#$2019
Extracted
agenttesla
Protocol: smtp- Host:
mail.tolipgoldenplaza.com - Port:
587 - Username:
[email protected] - Password:
Golden@#$2019
Targets
-
-
Target
1332000.exe
-
Size
490KB
-
MD5
997fbde85639834481305ad52fe98405
-
SHA1
418a61aa0b2e94a3fea886de1c5b195bc671c59c
-
SHA256
a044953a724f642c119477d17d23e389c44068773739e51d1b996cd6b2f51f4f
-
SHA512
5385d3830be67d0b87c4eef78b96d0ffa0dc8dc7bb5631b2b5059671f09631e03e9b8ba60f012b04e93411f68c960ac637c51fcf55ed810c27e9097d0828f0d6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-