General
-
Target
PO#88224.rar
-
Size
538KB
-
Sample
220930-qk3ycadfd4
-
MD5
c81c94145fa41b8800ab8ee1c8569338
-
SHA1
072f8ffb2e2ab8c3c8e16d2320e06e1ac0bb7e72
-
SHA256
36d5311e285d6a7d98347b86dd358772cf082365752dff389cf54778233f2351
-
SHA512
e9e06289728e1cfae5bf497735a4d6f5aa03301f241a6ca3dc072591d72e476806e2d8daf131ad044330d219773de35bf192d129f669b3d2bab9ae6ab8e7578a
-
SSDEEP
12288:wTN3ctVTo7+Ftei8VhzdtZ+vNhwZrm3YIkVqQdkbNSsn9hgptbTyn:wTirxoVhz7Z6h0FdkbNS0DAtbTyn
Static task
static1
Behavioral task
behavioral1
Sample
PO#88224.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO#88224.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5662683474:AAFvSjyPXTiwhBPcFi8of3_-_FCdfhhN8x0/
Targets
-
-
Target
PO#88224.exe
-
Size
972KB
-
MD5
b92f1e453834755986777a5bd5dc1d5f
-
SHA1
5751c9c918bc41c0e455dc81d8563687d3d981fb
-
SHA256
4084110bd1fa032556c1f16a3850f492716a343616f2eb27015d1f654ff1b9c8
-
SHA512
cccb9c4a8addaaf3a8048da50dc9f62b307cd3a23324a5ad9115b484d0190beee3909846bcbc37fe8993d1c3f079ec6a3e8c00bed2b7c2910dd04100d8d3a12c
-
SSDEEP
12288:PIo2Bn24peLKtzfWYCPsqScxtngS3xBADqjJ5npZxHgTW0P35Y5I/3f5eQFR3PAP:PIfB2VLKNWYCPLN9rjrzxIW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-