General
-
Target
SOA.js
-
Size
1.5MB
-
Sample
220811-g12ksadhf5
-
MD5
23e11cf48b007e75cf8eb5ac85bd389a
-
SHA1
0bfd334471fa6f1288afc686189411cb64da7c7d
-
SHA256
7f993bd4fcdbdac6ea35e1494590b38d84a264233ee18aa8686abc8de79d197f
-
SHA512
c5e811263271f63e496106d589b131485468e7bbb3ab4aeedeb03cfe31e0e3757d4f30a2741ba52d5c1c70dd0b360739ad0350c6002c9169cec34873e3aa6d92
Static task
static1
Behavioral task
behavioral1
Sample
SOA.js
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
SOA.js
Resource
win10v2004-20220721-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.losbrothersconstruction.com - Port:
587 - Username:
[email protected] - Password:
508135Pry
Extracted
agenttesla
Protocol: smtp- Host:
mail.losbrothersconstruction.com - Port:
587 - Username:
[email protected] - Password:
508135Pry - Email To:
[email protected]
Targets
-
-
Target
SOA.js
-
Size
1.5MB
-
MD5
23e11cf48b007e75cf8eb5ac85bd389a
-
SHA1
0bfd334471fa6f1288afc686189411cb64da7c7d
-
SHA256
7f993bd4fcdbdac6ea35e1494590b38d84a264233ee18aa8686abc8de79d197f
-
SHA512
c5e811263271f63e496106d589b131485468e7bbb3ab4aeedeb03cfe31e0e3757d4f30a2741ba52d5c1c70dd0b360739ad0350c6002c9169cec34873e3aa6d92
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-