General
-
Target
Kbchemie-Inquiry-jpg.js
-
Size
398KB
-
Sample
220815-tf7yaacgfp
-
MD5
eb0dd61bd5a623b612c5a76a77b64326
-
SHA1
ecf59d94fff9bb3b82f3adfcc73b6828123fecc4
-
SHA256
f191f1b022400f659511e61ce90eb0f225ac128139ab2592307d3efd736a1ac8
-
SHA512
7983017555ca3acfb0452ddb7023343af6705d5a2b24767ef014a407e5b9ce58af1e7d10e155be599f2d09f1dbccfcf2fbb5e64478b4f71d121332e22e3c4f0a
Static task
static1
Behavioral task
behavioral1
Sample
Kbchemie-Inquiry-jpg.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Kbchemie-Inquiry-jpg.js
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
server240.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
Success4sure2day10@
Extracted
agenttesla
Protocol: smtp- Host:
server240.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
Success4sure2day10@ - Email To:
[email protected]
Targets
-
-
Target
Kbchemie-Inquiry-jpg.js
-
Size
398KB
-
MD5
eb0dd61bd5a623b612c5a76a77b64326
-
SHA1
ecf59d94fff9bb3b82f3adfcc73b6828123fecc4
-
SHA256
f191f1b022400f659511e61ce90eb0f225ac128139ab2592307d3efd736a1ac8
-
SHA512
7983017555ca3acfb0452ddb7023343af6705d5a2b24767ef014a407e5b9ce58af1e7d10e155be599f2d09f1dbccfcf2fbb5e64478b4f71d121332e22e3c4f0a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-