General
-
Target
77d3c683c8750772235745fe300c88df342e1f22ecc77adb7c1b0f4980eaaaa5
-
Size
383KB
-
Sample
220521-ne16fsggaq
-
MD5
78fff13b27dee27c63bd3b6cab843146
-
SHA1
bbe4a3532bd8b86b4cb73e03b0dcf336117a4200
-
SHA256
77d3c683c8750772235745fe300c88df342e1f22ecc77adb7c1b0f4980eaaaa5
-
SHA512
af0521cd54423bfb1d93a63de16af56042196074c4fc68d520c004781946362152064e1005c5b900bc5b5324ec9367d874515f7defea84df16919bfc9f40ae06
Static task
static1
Behavioral task
behavioral1
Sample
Quotation00000-2=297=887.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Quotation00000-2=297=887.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bulletlogistics.in - Port:
587 - Username:
bangalorenarasapura@bulletlogistics.in - Password:
A}&N0S2?Xcrw
Targets
-
-
Target
Quotation00000-2=297=887.exe
-
Size
481KB
-
MD5
72df9489b54be3cfdba1722dc5f146d3
-
SHA1
4432df8eeb5264dddd40ba039b6dca0a36337337
-
SHA256
fb9ef9299560ef8ce20ccecc38804303b2f49e31955277075d580ec76d167682
-
SHA512
852ad79bc9680572f8162245323ff4683a1c8cba360d2195387ec4500b8be53fb6b21743d8eb44bf11ca8869b4ebbaea1fe421349099fbee90613472cf9d7d18
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-