General
-
Target
04d29c1407df011f35e6f0681c579a173230d01c1c937aa895219f43aa3c1f63
-
Size
378KB
-
Sample
220521-pcvfkaacbr
-
MD5
0763b05c66dbc504582cab1399ea3ec7
-
SHA1
12504fa6f2aa612a2198f904b2be65b25cee3722
-
SHA256
04d29c1407df011f35e6f0681c579a173230d01c1c937aa895219f43aa3c1f63
-
SHA512
c55e9e0ea3cc40020af8c1cb6fe1932c9a4edc512f3af1ca4dd2f98f65a78e507d33290de0d53444d418ace67f6ea7116f2cf89ba9748a2bf697e5c35913f9a2
Static task
static1
Behavioral task
behavioral1
Sample
Lochab Statement.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Lochab Statement.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.chirophysic.co.ke - Port:
587 - Username:
simalogs@chirophysic.co.ke - Password:
&qNJfDk}m&j}
Targets
-
-
Target
Lochab Statement.exe
-
Size
419KB
-
MD5
63268cc19d18110f40d4c9fab8139e64
-
SHA1
9f5b3933b402d07778ced6222e679213b3f02884
-
SHA256
cb66e8b2b867a469d59012b17c0c81be2900a9731529eb1d51073cbb92b5bb84
-
SHA512
dab348d999f24377a53316c2bcacac02733d19cbd68abea4632d92c5fce90b1d3c0813390e96458e848b4d28a6e903c25937457fd9c67d9cefab6ce9811687a2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-