General
-
Target
NEW INQUIRY.exe
-
Size
1.1MB
-
Sample
221003-hnmfrscbb2
-
MD5
4b7a780723c3eb78628a230a1dc7832b
-
SHA1
527490cf41c98d525817af17834a892de8f96a83
-
SHA256
cbf3e0891832e026ad5221a8e8d4aefc585b22439f14dcd4dba592bf99f82903
-
SHA512
46e97b92b6acc207b2c2be46994ccfdfb8639e8b2f50b650a4b3bdb69e8bbe888d21ba20a671e8ff4d76825a6531c6320202392e4d3c389693aa0100d4f26e7c
-
SSDEEP
24576:pr8r0rb/A17pSCEZW2AcDA9fqNZwe9FmfJjrg:zAlruWzcDUAZZc
Static task
static1
Behavioral task
behavioral1
Sample
NEW INQUIRY.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NEW INQUIRY.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.hussain-co.com - Port:
587 - Username:
finance@hussain-co.com - Password:
%%finance_@2018%
Targets
-
-
Target
NEW INQUIRY.exe
-
Size
1.1MB
-
MD5
4b7a780723c3eb78628a230a1dc7832b
-
SHA1
527490cf41c98d525817af17834a892de8f96a83
-
SHA256
cbf3e0891832e026ad5221a8e8d4aefc585b22439f14dcd4dba592bf99f82903
-
SHA512
46e97b92b6acc207b2c2be46994ccfdfb8639e8b2f50b650a4b3bdb69e8bbe888d21ba20a671e8ff4d76825a6531c6320202392e4d3c389693aa0100d4f26e7c
-
SSDEEP
24576:pr8r0rb/A17pSCEZW2AcDA9fqNZwe9FmfJjrg:zAlruWzcDUAZZc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-