General
-
Target
d856d9907f6ca5a877317dc01ff41ae9497acf60d678a2bf693489c0d48b7c72
-
Size
735KB
-
Sample
221125-lgr98abf4z
-
MD5
5e8e38e06be0f2a69da38410614ee67b
-
SHA1
8ec1b4ea24babb33ba48e89f4c3e58e18e1456fc
-
SHA256
d856d9907f6ca5a877317dc01ff41ae9497acf60d678a2bf693489c0d48b7c72
-
SHA512
a6f0cf2edb3b56b60e9220971a701e9fb74a34e91ee9e25b65a582e7b5d34aa54eb1a8f10fee7f68bfb6153d7a8457291d4224e7d9c32f3ca83d8d78bdb490d1
-
SSDEEP
6144:N89GgzazDFOkIU38gYvyZofbT9n6yv5LPQsahDlJhJTng/dTYbWHJ3:N8EsazoUlofn9n6mPQpn3JTg3
Static task
static1
Behavioral task
behavioral1
Sample
d856d9907f6ca5a877317dc01ff41ae9497acf60d678a2bf693489c0d48b7c72.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d856d9907f6ca5a877317dc01ff41ae9497acf60d678a2bf693489c0d48b7c72.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.omfoods.in - Port:
587 - Username:
[email protected] - Password:
Om@food11D
Targets
-
-
Target
d856d9907f6ca5a877317dc01ff41ae9497acf60d678a2bf693489c0d48b7c72
-
Size
735KB
-
MD5
5e8e38e06be0f2a69da38410614ee67b
-
SHA1
8ec1b4ea24babb33ba48e89f4c3e58e18e1456fc
-
SHA256
d856d9907f6ca5a877317dc01ff41ae9497acf60d678a2bf693489c0d48b7c72
-
SHA512
a6f0cf2edb3b56b60e9220971a701e9fb74a34e91ee9e25b65a582e7b5d34aa54eb1a8f10fee7f68bfb6153d7a8457291d4224e7d9c32f3ca83d8d78bdb490d1
-
SSDEEP
6144:N89GgzazDFOkIU38gYvyZofbT9n6yv5LPQsahDlJhJTng/dTYbWHJ3:N8EsazoUlofn9n6mPQpn3JTg3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-