General
-
Target
092c3e277c0d8a846ab9f5183233e66f_JaffaCakes118
-
Size
389KB
-
Sample
240328-sva2esae46
-
MD5
092c3e277c0d8a846ab9f5183233e66f
-
SHA1
1116e023916ac1b9bc106465b9971127c296cc81
-
SHA256
fcf486671fcfd181aeeb5d964a0e5fce563be5b9a15168e8ee8ff11e2d6192fc
-
SHA512
ecb1be28470ab77e8b3e08cdb20a1d93f4deb9f33dce306d291d1269be8b2205ed8cbb9f4d3e46c1ece976f27fcb08369db4f550d7dde5d091beae24aa67cd28
-
SSDEEP
12288:XVL4F/NRPlu0xTgen4aZ3CQYiyJb2x451A/g/:WFHI0xTgen/CQmJb2b/I
Static task
static1
Behavioral task
behavioral1
Sample
BL-SHIPPING INVOICE DOCS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BL-SHIPPING INVOICE DOCS.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bsia.co.in - Port:
587 - Username:
yogesh@bsia.co.in - Password:
21mbsia@)@!Y
Targets
-
-
Target
BL-SHIPPING INVOICE DOCS.exe
-
Size
448KB
-
MD5
1443ecb318ff158823692945f04e0a14
-
SHA1
fba634c395ca7bf82496d04e5b45822611db65e5
-
SHA256
fa9744a9f8530dfe050f21fd9b85a9cabfcfefd30b5290355e3ea6b6c8136b6f
-
SHA512
ccc22d778f9369b3d38e9658216a1600602f951f7c437aaa6c1292f0bae7eb94dedbc3456cc0ce832a1f9f9ac2e11a58f8c459eb4a215d0b829ad6ae1da06aa5
-
SSDEEP
6144:aHERGpLRGW22gxFfF1UOVGuklso07Lnaorfxl+y3POaTtDy6JDDT5voaZ5CgZuU9:aHI2LHoF/LN5nysTTgmnaaZ5CgMiyIQ2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-