General
-
Target
PO-23-0103000RPM.PDF.exe
-
Size
823KB
-
Sample
230206-xxmv8aaf8y
-
MD5
f623a5768af272301f33b27655fcbb90
-
SHA1
74b12a26b9c94a871b0d89c000b73182a9aa3f4d
-
SHA256
92d13e09fd15a7a89caa8753d0fe0f8be6ac49f402a4bbae0da6a6bc57d21c33
-
SHA512
1390ac48156c882e26e35949b99242980b4449b828731691dce92ac51828757acd86353022b0c69cdbce85f1ee37ea46403752a9b93e7f8687457533ff19aac7
-
SSDEEP
24576:UA3XrxN5IC54TWMWpRo0ysh23SxqoS8w0b:DrtgiBpG0ysAGqr8w
Static task
static1
Behavioral task
behavioral1
Sample
PO-23-0103000RPM.PDF.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
PO-23-0103000RPM.PDF.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5677685939:AAFELEmWBrxMnyX4KiFEXWGKBWoRi9TCLHE/
Targets
-
-
Target
PO-23-0103000RPM.PDF.exe
-
Size
823KB
-
MD5
f623a5768af272301f33b27655fcbb90
-
SHA1
74b12a26b9c94a871b0d89c000b73182a9aa3f4d
-
SHA256
92d13e09fd15a7a89caa8753d0fe0f8be6ac49f402a4bbae0da6a6bc57d21c33
-
SHA512
1390ac48156c882e26e35949b99242980b4449b828731691dce92ac51828757acd86353022b0c69cdbce85f1ee37ea46403752a9b93e7f8687457533ff19aac7
-
SSDEEP
24576:UA3XrxN5IC54TWMWpRo0ysh23SxqoS8w0b:DrtgiBpG0ysAGqr8w
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-