General
-
Target
Inquiry_________________________________________________________________________________________.zip
-
Size
3KB
-
Sample
221003-k7tqasfhd9
-
MD5
8d9a63b6e86fb4940b5ed91e28b9b875
-
SHA1
6f6f219ebc82f42f6b0f94e79927a46de1eecf1c
-
SHA256
7083502f034943a79c2166cf04dae9a5f08e47f4cd1c32b642f05e8e00a4b3d6
-
SHA512
904c2dd133dfa32df1d4915a38cd65aa9479cfca2057eaed33f90b49abd87ec56b5349abb76c9385a173d6ddcf7fcbc0a451921529f7421789409efc52b20ca9
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry_________________________________________________________________________________________.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Inquiry_________________________________________________________________________________________.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.nisusenergy.com - Port:
587 - Username:
nisus@nisusenergy.com - Password:
Nisus@64787
Targets
-
-
Target
Inquiry_________________________________________________________________________________________.exe
-
Size
7KB
-
MD5
d5e6d91cbd4ae175f42b367d9c93d518
-
SHA1
b4e93a6d5b063db5acdb77548d088b3426a3b1d7
-
SHA256
2771e93e3caecd5a636083b4992aba9c96c839958f148455754f3de1ba7b517b
-
SHA512
fd3f3bb993469a55d70d77c8dc662b8667290c886fc6c312cae2a010a05887c5bc2912c35d6366ef67ff3b773f051331986862cbdd30172717cb33030eea0edb
-
SSDEEP
96:nO1eHUD8npvUJS8yWLHyLXMIzlIRzfsRQ+pw2vKDedqS7zNtR:O1HDspMrLHyLXpzStfV+plCDehdX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-