General
-
Target
Shipping documents.PDF.exe
-
Size
753KB
-
Sample
221125-pp2emsge79
-
MD5
c95c355e8ef742a2b6c165ff6b6c4ae4
-
SHA1
9818b3e5305a425c6d06984c79a35353457c30e1
-
SHA256
2cae27fe5b93620d4d7f1b6e16566c618c23aaa11230ebb33a2bf57c0e576202
-
SHA512
f111692d9815a79f44d543ac4c171fe424168a0ea4f605fcf7bf17d6c9fa23c9ce3b2443139ee018118fb68efa8b214af9854e814a718249c951f7cabc72dc67
-
SSDEEP
12288:4bsbERS6OQ0H9vM7zrbETClBkFg/IyXCD8Hk1dnkyH2lrioPUGjAIm5B2yqA2X+F:4QbwS7H9U776CPkFg/IyXtmdnzKGaUGu
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents.PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Shipping documents.PDF.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5495243543:AAG3XPeGW7yqfXF6_EXjGSfO9SWHJTpqVsU/
Targets
-
-
Target
Shipping documents.PDF.exe
-
Size
753KB
-
MD5
c95c355e8ef742a2b6c165ff6b6c4ae4
-
SHA1
9818b3e5305a425c6d06984c79a35353457c30e1
-
SHA256
2cae27fe5b93620d4d7f1b6e16566c618c23aaa11230ebb33a2bf57c0e576202
-
SHA512
f111692d9815a79f44d543ac4c171fe424168a0ea4f605fcf7bf17d6c9fa23c9ce3b2443139ee018118fb68efa8b214af9854e814a718249c951f7cabc72dc67
-
SSDEEP
12288:4bsbERS6OQ0H9vM7zrbETClBkFg/IyXCD8Hk1dnkyH2lrioPUGjAIm5B2yqA2X+F:4QbwS7H9U776CPkFg/IyXtmdnzKGaUGu
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-