General
-
Target
final SEAWAY BILL pdf.exe
-
Size
908KB
-
Sample
230328-jbvgaahf36
-
MD5
c1b8b4e30ea64942210e7708131fcb6b
-
SHA1
e9c5e2c762225ff260711276313b37b8ca5e491b
-
SHA256
1cc3f2ee6a83832c378f4369c71aae81616ebf016af234e6c71e59fa5e807ec2
-
SHA512
6bca34084961117d64be62deb809c6b6aa1273ec7986a2b659434af02b5472cfd01725c30d227b09bb02004762978e63542af3ebc5ffbf042aaeecd2e43e70e6
-
SSDEEP
24576:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+gXd/qwvagNd/xFPoFuywVdDwCbJKATsI2:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+X
Static task
static1
Behavioral task
behavioral1
Sample
final SEAWAY BILL pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
final SEAWAY BILL pdf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/
Targets
-
-
Target
final SEAWAY BILL pdf.exe
-
Size
908KB
-
MD5
c1b8b4e30ea64942210e7708131fcb6b
-
SHA1
e9c5e2c762225ff260711276313b37b8ca5e491b
-
SHA256
1cc3f2ee6a83832c378f4369c71aae81616ebf016af234e6c71e59fa5e807ec2
-
SHA512
6bca34084961117d64be62deb809c6b6aa1273ec7986a2b659434af02b5472cfd01725c30d227b09bb02004762978e63542af3ebc5ffbf042aaeecd2e43e70e6
-
SSDEEP
24576:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+gXd/qwvagNd/xFPoFuywVdDwCbJKATsI2:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+X
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-