General
-
Target
NEW INQUIRY.zip
-
Size
655KB
-
Sample
221003-hm25tsdfdq
-
MD5
fac06bd958ee014c28ea76755864cf5f
-
SHA1
6cec708239d3e9f00e5de74d99a3d38fea72a4e8
-
SHA256
ecdb3abb1c9090bc5ee530ee7766e972019f292063d737dbcf62034db1b31eae
-
SHA512
32e5466d945656ea30d8cc5c1eb4d50ad197b9fa60476d9ac6152627714ed42862b1e09f5d4fc8821cabe76da98960716faf0a498709e26c0e032c83c51c6b15
-
SSDEEP
12288:e3V5dLjoVJjYSeCoZFtjz6HaREZ2VyH5eWuYDAqIfqNNhwYhtMcFaLpOfivbOL2H:e3Vz3MJjYSeCoPtSgEZMgeeDA9fqNnwL
Static task
static1
Behavioral task
behavioral1
Sample
NEW INQUIRY.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NEW INQUIRY.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.hussain-co.com - Port:
587 - Username:
finance@hussain-co.com - Password:
%%finance_@2018%
Targets
-
-
Target
NEW INQUIRY.exe
-
Size
1.1MB
-
MD5
4b7a780723c3eb78628a230a1dc7832b
-
SHA1
527490cf41c98d525817af17834a892de8f96a83
-
SHA256
cbf3e0891832e026ad5221a8e8d4aefc585b22439f14dcd4dba592bf99f82903
-
SHA512
46e97b92b6acc207b2c2be46994ccfdfb8639e8b2f50b650a4b3bdb69e8bbe888d21ba20a671e8ff4d76825a6531c6320202392e4d3c389693aa0100d4f26e7c
-
SSDEEP
24576:pr8r0rb/A17pSCEZW2AcDA9fqNZwe9FmfJjrg:zAlruWzcDUAZZc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-