Malware sandboxing report by Hatching Triage

General

Target

665aedc941ee4a7f199bad9431099c3591368f895c13b8be6f17dc29b2bcb66a
Size

1MB
Sample

220521-pk1mjsafhq
MD5

9f03d6a136d77ce5e2f1593af57c8b40
SHA1

323b0e1df12af446034a7b5851cfc94db356b5d7
SHA256

665aedc941ee4a7f199bad9431099c3591368f895c13b8be6f17dc29b2bcb66a
SHA512

bef2ff15a02b7a0648680b72cb42120f13ad238c349b3ed4615ab6a5e354710986a0eebf053e1d10bd3adb7779ddbbf77adecaeb45a08ca3964c07edf5f9d409

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.fakly-cambodia.com
Port:
587
Username:
elesh.ly@fakly-cambodia.com
Password:
Mmhh#2014

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.fakly-cambodia.com
Port:
587
Username:
elesh.ly@fakly-cambodia.com
Password:
Mmhh#2014

Targets

- Target
  
  NEW_ORDE.EXE
- Size
  
  521KB
- MD5
  
  52133a225e1285915e4c871f802db4e0
- SHA1
  
  4a61cccd463daa442568f98263d5a9944cc724b9
- SHA256
  
  08e3928e063f4d85e7580cb03a62d69e7c3c0ba1bd04e2867343931e335862bd
- SHA512
  
  bdb76a4ec24d16e9c3f6ec3e7f30b698743d0818c2167793441528477aec89d2712962ef66cae3e9b43516f90bd644e386308c2c0971ccf6940d43cf2664c301
Score

10^/10

coreentity evasion rezer0 agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2