General
-
Target
a45ce08efa0bb11b035a7c50edceab5fd932f4c37705b34dda80a38d10e0cbf6
-
Size
475KB
-
Sample
220521-pg8traaeej
-
MD5
5adb56d6631fc8b829345fd13435b1ae
-
SHA1
0957b32fc81d4aacfe230f1e3f81327b011ff7f0
-
SHA256
a45ce08efa0bb11b035a7c50edceab5fd932f4c37705b34dda80a38d10e0cbf6
-
SHA512
d161b7dee04548dfa968a7fdf169829f7e5cffac49b97b0217ebb2b799583a8c51af28fe7a594024b4b73b13614dc1245998a4df1ecaf8757ab5d5791ee1e7b7
Static task
static1
Behavioral task
behavioral1
Sample
PO 186603, PO 18582.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO 186603, PO 18582.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kanzen.com.my - Port:
587 - Username:
lee_yokeeng@kanzen.com.my - Password:
YELee@1919
Extracted
Protocol: smtp- Host:
mail.kanzen.com.my - Port:
587 - Username:
lee_yokeeng@kanzen.com.my - Password:
YELee@1919
Targets
-
-
Target
PO 186603, PO 18582.exe
-
Size
666KB
-
MD5
512744ba053431744d5d37a17417d174
-
SHA1
b4e48a6841b0b97da10e4c059173acc61be6ff5a
-
SHA256
02fafe7d00909727bb91670774f201dc8ed5122c7c0c6c25c2c8b227b6a77df4
-
SHA512
08d5221ab927266a28e8fbaea4d9a22c2fc183905fd5fb34849196e30b563e759a1ca04f05bb696e3271fdcb13859542a32fb5b30c8bf19b7a0c0bee54f6a912
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-