General
-
Target
af2e6539074c4dae12ebff3cb79528b4a2a319ba6b5ef62d5c7c7532da3e2ebeN
-
Size
2.8MB
-
Sample
241026-c67a1awkfq
-
MD5
b76ac2d525461ecea565b3328b0577d0
-
SHA1
3b7f71b3348c842b2bd96fba18e2361b2f20cc53
-
SHA256
af2e6539074c4dae12ebff3cb79528b4a2a319ba6b5ef62d5c7c7532da3e2ebe
-
SHA512
c9166577f1af3f8482c8dcc27ae1746613cba56289997600f1f68e73a072d831d2beb0709f7c68fcd18f0e0b4efbbab54fa5dcc77fb57f450c21c997917c1e82
-
SSDEEP
12288:mP7r9r/+ppppppppppppppppppppppppppppp0Garcy9OjzUoSSGts12uik/As7g:m1q0OjzUoSnIiXs712heuYGCg
Static task
static1
Behavioral task
behavioral1
Sample
af2e6539074c4dae12ebff3cb79528b4a2a319ba6b5ef62d5c7c7532da3e2ebeN.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Targets
-
-
Target
af2e6539074c4dae12ebff3cb79528b4a2a319ba6b5ef62d5c7c7532da3e2ebeN
-
Size
2.8MB
-
MD5
b76ac2d525461ecea565b3328b0577d0
-
SHA1
3b7f71b3348c842b2bd96fba18e2361b2f20cc53
-
SHA256
af2e6539074c4dae12ebff3cb79528b4a2a319ba6b5ef62d5c7c7532da3e2ebe
-
SHA512
c9166577f1af3f8482c8dcc27ae1746613cba56289997600f1f68e73a072d831d2beb0709f7c68fcd18f0e0b4efbbab54fa5dcc77fb57f450c21c997917c1e82
-
SSDEEP
12288:mP7r9r/+ppppppppppppppppppppppppppppp0Garcy9OjzUoSSGts12uik/As7g:m1q0OjzUoSnIiXs712heuYGCg
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks for VirtualBox Guest Additions in registry
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1