General
-
Target
Import Invoice Duty and Clearance.ppam
-
Size
8KB
-
Sample
211019-j9la9sgcfq
-
MD5
7659d46dbf1d34e7833e4b0b2968f281
-
SHA1
05f65097aefb7a9c8269ef63d7aec4764079b970
-
SHA256
0cabc6544bb554fc6900c766ade30bee9bd403f64231e87b65fc9182128d7515
-
SHA512
db5f925cd241e429593c18148f9b9ded717ef87bf935a9d134579d1139c23292201803104910896ef4ecde4891735690b2826f82cefb6762d61763244e94e4ec
Static task
static1
Behavioral task
behavioral1
Sample
Import Invoice Duty and Clearance.ppam
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Import Invoice Duty and Clearance.ppam
Resource
win10-en-20210920
Malware Config
Targets
-
-
Target
Import Invoice Duty and Clearance.ppam
-
Size
8KB
-
MD5
7659d46dbf1d34e7833e4b0b2968f281
-
SHA1
05f65097aefb7a9c8269ef63d7aec4764079b970
-
SHA256
0cabc6544bb554fc6900c766ade30bee9bd403f64231e87b65fc9182128d7515
-
SHA512
db5f925cd241e429593c18148f9b9ded717ef87bf935a9d134579d1139c23292201803104910896ef4ecde4891735690b2826f82cefb6762d61763244e94e4ec
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
AgentTesla Payload
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-