General
-
Target
d8c393bd9671437f2e0618b772639fe6bdcc1678b160fc72a257f0ae220bb3bf
-
Size
391KB
-
Sample
220521-ny8pmsech9
-
MD5
2db30c14fd0b3fec94cf0ba512810bf8
-
SHA1
923d40fa97fcd7dd2bb5374801403de550e040d4
-
SHA256
d8c393bd9671437f2e0618b772639fe6bdcc1678b160fc72a257f0ae220bb3bf
-
SHA512
a6921cb77ff4aebd5f202162713fc3d73f45f38cbcc1666a4273aafc96618345f2e5a62b88774a3d9d879dbdbf34353ee623790b3a2471747453f3101424129c
Static task
static1
Behavioral task
behavioral1
Sample
Remittance advice SLIP.PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Remittance advice SLIP.PDF.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.microtechlab.in - Port:
587 - Username:
reports@microtechlab.in - Password:
pune@123
Targets
-
-
Target
Remittance advice SLIP.PDF.exe
-
Size
424KB
-
MD5
f0b3e2a7cef0d4e0c6e094676550221a
-
SHA1
fc8cddcf6526cd3ee94141b6299c7069ad1b19b0
-
SHA256
6ae9b8c271b5110c7cceb8b7d39522dd8d444dddcfa3691726ff3580562a73b7
-
SHA512
3a0f6d6e979871ecdf4cce66e63674ecd32568f0d45f91448b0bb986fccbbf3173734f992d6c0add58c5437fd048e36c4b00bd8efcbcf5c161b35b8c7e26178a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-