General
-
Target
bf7a2a92da568615c512c1a53f0937242139002da39f3e51c94cd008f9a494c6
-
Size
405KB
-
Sample
220521-nq2w5ahbdm
-
MD5
9f81c744b74d9a3bb8ace9cac71ce7e6
-
SHA1
7825ee05c6d58c1143b77e23e3ea6f821fc3735b
-
SHA256
bf7a2a92da568615c512c1a53f0937242139002da39f3e51c94cd008f9a494c6
-
SHA512
3bc84a7c387b36e39fb86ce9f4c7074d2d6ec1c8f1b968ccf4ab6c4d53acae8f70004753a7c1c27fd855c5d621aeae4b1644c6e0d2c6e19482cd531d1b9ace54
Static task
static1
Behavioral task
behavioral1
Sample
P.O 28602 21256 Hebei Ocean.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
P.O 28602 21256 Hebei Ocean.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
logs2020@gtbenk-plc.com - Password:
mkoify147@@@
Targets
-
-
Target
P.O 28602 21256 Hebei Ocean.exe
-
Size
455KB
-
MD5
104e8b102a6b386887f808cbd94901ab
-
SHA1
250fa8b466ac9af5f1a26487f05cba52a68143d9
-
SHA256
e498a26bf37aa6df233829a04b8c92410e2491f7a755f191b6cab151f4fa8d03
-
SHA512
7cdae82f736fd8de46a05f4c5604e04ecace748f4c747de7ac570e85326927e9c79dd91b3b15733d5206836d538641a5295f0c182729c57c8b47295737bc1ec0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
CoreCCC Packer
Detects CoreCCC packer used to load .NET malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-