General
-
Target
4278e2830a06201c8d2bd5352272fbe141c0c245013a2de2d1b6e221d7b0550d
-
Size
488KB
-
Sample
220521-pmdwkaffb2
-
MD5
cac43c4a8d9685cfb93a18788061d035
-
SHA1
b9eba05e78b20d20f7ae3fb52e1da3b5f38cdf46
-
SHA256
4278e2830a06201c8d2bd5352272fbe141c0c245013a2de2d1b6e221d7b0550d
-
SHA512
aa05979632ef42e6f6e6726d0d6ba393b1b93a883b99311cbc371ca4947cce48cfc7fdd1b736f7b6e9a4dc0d8d0893c42d550c93a722aba7d37cf26c56c599bb
Static task
static1
Behavioral task
behavioral1
Sample
OPLSU19HP4286.gz.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
OPLSU19HP4286.gz.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ahrass.com - Port:
587 - Username:
mohamedadjal@ahrass.com - Password:
chukwuma22
Targets
-
-
Target
OPLSU19HP4286.gz.exe
-
Size
598KB
-
MD5
7a2ea0c3cc1f0c59f5d35a09843ce4f2
-
SHA1
2b224c79f1392587d91b3e9c379b9a23adc4767d
-
SHA256
a6599b417be167f4a56b09497a4e42a60305c59b564b872246c2c6a6f368c44a
-
SHA512
89d867eaa6f51bda727acac536a3e748cbaa1e6eb08d92883b252b361ca100f4cb2acd0dbcf8d5d5e4591adf506c32c2a042b4e6eecd67a45cb2c541ce3002a6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-