General
-
Target
Product Information.img
-
Size
2.4MB
-
Sample
230328-rcfnhsda8t
-
MD5
978811adc951f6476d8faacb3cd10180
-
SHA1
dd2a631945086cae5818ef5ee058f1fc4f07b456
-
SHA256
0e6e84d2b0c5e068a569ed89fd3cf6078c07a89cc1ced4d43da947d3fb5c331d
-
SHA512
2978cc6949b194a06535f33103b4486cc02ca659d0c9541a47f8f413d871cb0b6169e5b19d3de57643cdc9bd09022f670e38e246e3980d04331066a8c701a8a8
-
SSDEEP
24576:1HF9lwAzp8bY1KKtu1Dze6HDpLuhyleNUQggSwVSCrFCmejtZ34qVUu9YMTAyMrc:zwuyll0HAmASJZ6hGiAXBNxot
Static task
static1
Behavioral task
behavioral1
Sample
Product Information.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Product Information.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.yurabeauty.com - Port:
21 - Username:
zzz@yurabeauty.com - Password:
computer@147
Targets
-
-
Target
Product Information.exe
-
Size
2.3MB
-
MD5
1bd0da24111aeecb224a8e7efb0b16a9
-
SHA1
81b1b013d0d880543b62825caec86772271a0f7e
-
SHA256
e37407c73671a517423ddaa15cf05ff2f90659de57dd777480db965f25a528d7
-
SHA512
ef6e76af13dcde118995135b8ee0e5293ed433e378b7bb84a0bceeb3ac082f3f5090b1943807ea83f156d2c17555490f04251bcb21e5a913ab8620500af10bf8
-
SSDEEP
24576:nHF9lwAzp8bY1KKtu1Dze6HDpLuhyleNUQggSwVSCrFCmejtZ34qVUu9YMTAyMrc:lwuyll0HAmASJZ6hGiAXBNxot
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-