General
-
Target
Purchase Inquiry_pdf.ppa
-
Size
88KB
-
Sample
220808-g5224sedhk
-
MD5
66e90bc339b81848e91170d144b6bc32
-
SHA1
c48b225a8b0dfba3d69ffb235c338605a181da1f
-
SHA256
e868bdaed1ba329001ce3f170b73715fe72f7543fd6b4a651cbc9dd60631ce70
-
SHA512
cd9b189f1afabe6b819e18cdda11ce565eb626a35f8ebbf6202bb843eb44fc6bafbdffe47de03cf3b88d2936e8161a64d8b90e738f1cfff2381f88ebd0f44540
Behavioral task
behavioral1
Sample
Purchase Inquiry_pdf.pps
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Purchase Inquiry_pdf.pps
Resource
win10v2004-20220721-en
Malware Config
Extracted
http://bitbucket.org/!api/2.0/snippets/warzonepro/8E74BM/47d1c5bd6af9e6b1718ba4d2e049cba6beb1ac95/files/charles1final
Extracted
https://bitbucket.org/!api/2.0/snippets/warzonepro/LMkqo4/5177d531010570f368daf83c5af3e240a6404d8c/files/charles1.txt
Extracted
Protocol: ftp- Host:
185.136.167.144 - Port:
21 - Username:
charles - Password:
TinyDev@123
Targets
-
-
Target
Purchase Inquiry_pdf.ppa
-
Size
88KB
-
MD5
66e90bc339b81848e91170d144b6bc32
-
SHA1
c48b225a8b0dfba3d69ffb235c338605a181da1f
-
SHA256
e868bdaed1ba329001ce3f170b73715fe72f7543fd6b4a651cbc9dd60631ce70
-
SHA512
cd9b189f1afabe6b819e18cdda11ce565eb626a35f8ebbf6202bb843eb44fc6bafbdffe47de03cf3b88d2936e8161a64d8b90e738f1cfff2381f88ebd0f44540
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-