General
-
Target
PO#RFQ-HL51L07.zip
-
Size
474KB
-
Sample
221123-p7g4qadb84
-
MD5
492e6323b17c1e7bce3b845d10da41f5
-
SHA1
6054a147c8d87f08741a8c23abcd95790001818c
-
SHA256
4d042c04a3d9b69ceb5e990caf8fe2a9d2f578f51f74df0fc2c152b2de571b37
-
SHA512
d016aec7045929049aa4e66a7279f34449101da108121a50049aa206a21391a47c04617cdbb4be0de7d5788bdb16ed1aa82a439870cb507f290f5ebee353fd3a
-
SSDEEP
12288:un4xouOWe4Bcw7loOy+7OoGDL846WF9kB0gVW:un+orOBrh9y+y3DLZFQ7VW
Static task
static1
Behavioral task
behavioral1
Sample
PO#RFQ-HL51L07.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PO#RFQ-HL51L07.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.strictfacilityservices.com - Port:
587 - Username:
[email protected] - Password:
SFS!@#321 - Email To:
[email protected]
Targets
-
-
Target
PO#RFQ-HL51L07.exe
-
Size
572KB
-
MD5
e10777c560dcacc0537c588c2999bd7d
-
SHA1
127b2a6444a323070ec31643dabfa3803ffe2ec5
-
SHA256
5b72b74c569f9a1593b4bf313a02db7e10f9e8ffb5ed73ee73ed76b1c53ad13f
-
SHA512
9339898e57c77be6966a1cab1fb39860b720e762fabcbfc8c21ebf5d3995b4c907910536eb0415a404dce2e9d06dc5176d2ef6b8e1620370556798a7825eafb8
-
SSDEEP
12288:Ox3aWpUo67IMwM8yzwElEkj76s4DSABfUnNI1ic6DlQOys7OoG7P8M6cFmX3Z7i:l6s4DSuUNEiT5Fysy37PjF6l
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-