General
-
Target
757549d7c173934192681bca78e6733c9a603d154f43aaec46f1da04a7121fb6
-
Size
573KB
-
Sample
220521-pwgc2sbcfp
-
MD5
3a956572dbc7bab624cedfd3bb3bc131
-
SHA1
1c6957d78f1cd95ed8cd00fa3ff5447eb094d328
-
SHA256
757549d7c173934192681bca78e6733c9a603d154f43aaec46f1da04a7121fb6
-
SHA512
c3bb6addd2749b33f8b23eb592af94583a8b3144e42bb5049d47726eb225f910563fc4785855cf7d9fa71b0fea05c14deb5a8d7f8c9e30f86bc05a4f953ce82c
Static task
static1
Behavioral task
behavioral1
Sample
未付发票付款USD_.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
未付发票付款USD_.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
未付发票付款USD_.exe
-
Size
606KB
-
MD5
e26c1a2e7a9cc1d8123376e0d3463578
-
SHA1
3d6694eac8f1ffd542a597a3ae99909511c2af0a
-
SHA256
f926c0f688d754fe65d6920b383aa16bf9aeb87910bfd1138fbe32e271a46eda
-
SHA512
546e6ad52cd746c5466572a34cc329f3334a6069386549b49c365cc4e57416288dd952a2cc5aed1040842d7b3ba07229a1279fc2fe9c04fb0a96224fc445cd4d
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-