General
-
Target
bcfd4926d980339e5b2532aae3f2f5b18fe3ec68117e5887eb336d1ded541687
-
Size
646KB
-
Sample
220521-nd7a3sdef5
-
MD5
a0fd9efe320e7f13def90718e7247e08
-
SHA1
f517eb38628ede8d380a5428f27a6b9600cef8e5
-
SHA256
bcfd4926d980339e5b2532aae3f2f5b18fe3ec68117e5887eb336d1ded541687
-
SHA512
1a967cd62544402ab1e9e8c9e6ccff28fb242e547f5a900fb49d6cd2559f88f0a8acbacb781b74b3f5a483c6e7ff51317d01d112baa3c14b647c842cfd1240d5
Static task
static1
Behavioral task
behavioral1
Sample
payment.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
payment.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.temakaw.com - Port:
587 - Username:
babul@temakaw.com - Password:
Ef@02441678
Targets
-
-
Target
payment.exe
-
Size
831KB
-
MD5
c8677f9ced0a242bb49c3134abcbb4fe
-
SHA1
865119d268a63941b71d0ff31edf597c396b03a9
-
SHA256
7734e25db8cbf20b6c2d907fe0d9bb77bc797849ad456de9a930a19e27e2212d
-
SHA512
4027c57919c10d34a5e209be46c97e579ca546571e7e1e62674a589aeceda3805891c3d0c114f438f754888c7b36fc15493c9d019df62618a4a7484a690578a5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-