General
-
Target
13949e64a5f8277e4614294a45528a4d43f22d03829f3c477533e35d93c0df59
-
Size
504KB
-
Sample
220521-pc65csacdk
-
MD5
945856cf053bb6dc09c0f83674d41287
-
SHA1
5b5b4498f1864856298ca9f13a0e0b90ba2b0f71
-
SHA256
13949e64a5f8277e4614294a45528a4d43f22d03829f3c477533e35d93c0df59
-
SHA512
bad61d01b23f3aa8a79b88a4b5d8b8c2a33db80566a0d3f7ce3ce41e60e818e72492548aebef5a50b60c96248e5c8af0ab4d335ef40179d4858545e5ec43d0b8
Static task
static1
Behavioral task
behavioral1
Sample
Scan Document 06311_PNG.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Scan Document 06311_PNG.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
dtoydreamer@yandex.com - Password:
internationallove123
Targets
-
-
Target
Scan Document 06311_PNG.exe
-
Size
869KB
-
MD5
26ca848025d9021542081e7983e577b9
-
SHA1
2db08626337ac47a8c024bd1ec0f9da603c762d0
-
SHA256
718612fc81bf6ba414792fdd4167f7571295b147c14377130931f4a096fac2f2
-
SHA512
22d81689a3ee8cba9c99ad9170ed558affd3a3bff9f4dc6ca52c395f85a96af94290e43df5d865762e8ba71e53cffbc420b7586e05d1aff88ba34a362a7a7cef
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-