General
-
Target
Shipping documents.r11
-
Size
833KB
-
Sample
221128-prh13shc4w
-
MD5
f7099b28961ed754fd764a86845a4ef4
-
SHA1
255d4cfa123a2513c744e51432877ad55a1ab9af
-
SHA256
6a470b74c05807c039f5a2a3b21fb6e33daf09ddc59cc6416ec44c971a0663aa
-
SHA512
ef754d372cc54433988332e31bb834ed112d6bb0884232f8a8c0655eb8eceb18933eec818d59f0c31c484e7772ef1a81b49ad96419291e136caa0121fae019be
-
SSDEEP
24576:ttD7kOVMG0O9CnD2njPEwyeJ4KFebrXSJ4i4C:nkOWMwD2OelF+rviP
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Shipping documents.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.biateknos.com - Port:
587 - Username:
[email protected] - Password:
biateknossutinah - Email To:
[email protected]
Targets
-
-
Target
Shipping documents.exe
-
Size
960KB
-
MD5
a0b2a10e84abe8930570103f841bcc75
-
SHA1
441c100f5467f1e7983b3e62119b60bb3cc757d7
-
SHA256
ebb86221b5c4336e8155321c3ef818e39e38c981227b768433d107ba6aa3bd69
-
SHA512
023c0e59dbdd9dd8f3b2e3ad99154942d651e7b3c3b498e25d957fb4b717dde7148a932bc1cfd1a4a9679889fcaa22de8b25d75ae14f01e12c3a25ef248794d5
-
SSDEEP
24576:EGU376CRkFg/IyXtBbvShFasPKhCX0sTLZeD1zBCh:2PkoXvSLSkzTNk1W
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-