General
-
Target
46bd933a2f3d328c9b9665c2b8c9907600e14b3542d9aff1e8526593cd03a3cb
-
Size
438KB
-
Sample
220521-axdk8aahf3
-
MD5
21802db473eff5bafefc5a065d51a270
-
SHA1
b9948b9ac967ab3e3663e3cfa3e75b734851baf7
-
SHA256
46bd933a2f3d328c9b9665c2b8c9907600e14b3542d9aff1e8526593cd03a3cb
-
SHA512
9261281cc0f68bb8ff1399d496b98c192487cb7729334f7abc80cc603c2b34556e733a1a23e7018a6474c63c04829e8b1a0492d217dd3db91dd350e0c17c4cca
Static task
static1
Behavioral task
behavioral1
Sample
PAYMEN.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PAYMEN.pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.daafco.com - Port:
587 - Username:
[email protected] - Password:
Rawan!@#
Targets
-
-
Target
PAYMEN.pdf.exe
-
Size
648KB
-
MD5
463c68f81d7624d1a22aef526b98ff62
-
SHA1
047605c15f2fa7421c7855e2410ae1de5a337a3f
-
SHA256
638603145c3aac570237325613344a3fd83bf2fc737ee5acd8230e0ee1afb0f5
-
SHA512
5ff2d32b68fc4a9b3c9babbfdad0c9b621c88dbc402f8edc1c4a4893d6e2c5f3b74ad5f73586ba5e58f9bc859840d1e80288e3cadd8205ab6be77b89a8f20e1b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-