General
-
Target
Payment Advice.uue
-
Size
1.0MB
-
Sample
230327-vq696sed96
-
MD5
1c5f2525ad6f9d75a37fe2f19ae86874
-
SHA1
4ec6cfb30ba46d5f25a20882e34a79d93308e0c6
-
SHA256
29efdf272b04b30f02ea92893e88ce3d41a3c30f887e564cbc3a62b9d31d2904
-
SHA512
517605079d1f02afbd631b052c7a92702b8ad1a80855373e00d63535bd6cdc609c93d948ddfc10bd21883b11ca97da419099a9c5efb55a91c7bc73eefda68a6f
-
SSDEEP
24576:dgi/pGRkPZnm0xHvnHRhIpNdqqaYgE2u6KWkwc98:d/C2nm8Hvz+NQqaYJBXH98
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice_PDF.scr
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment Advice_PDF.scr
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
baitunniniola@yandex.com - Password:
skckiglxqgwrfpxh - Email To:
baitunniniola@yandex.com
Targets
-
-
Target
Payment Advice_PDF.scr
-
Size
2.4MB
-
MD5
5d5a06166ce1d99636634c4016618c01
-
SHA1
8102c713286ace56d07914cc6164e27412d2d17d
-
SHA256
09da622ef3e5d5a12d5b51075e06a1ed054ac21d37eadb07cd901366150895a7
-
SHA512
3732f1d8fe6ad4b25639799c21f9d590ebbfbae7d648db99d1e3f21f752a7e0f3db11c0217d29ffb745ed814100f435bed879a9db8b2a1ebf2a12213b4575ec9
-
SSDEEP
49152:6T2UxXSau0WZL41of2iBUQQ/xD6WWdru:ff2bQQ/xD6W
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-