General
-
Target
STATEMENT OF ACCOUNT.pdf______________________________________________________________________________________________________.exe
-
Size
974KB
-
Sample
231208-sqrhlscch4
-
MD5
b624b22306191a4001991e6a98a7633c
-
SHA1
f519bef2574df8f8a8d0fc5d19f029c72d9a1182
-
SHA256
a2d18105194e15ef86987c3eba487d3c98e4ffcc9f5df8fff8c2c71559729641
-
SHA512
114151d9dcb4c24168602beb97671dd9e733ab4e49771132ffff18f41d598246b096b751e266347267593539843b0a1967a34547298c1190c2a9626ab1a23edd
-
SSDEEP
24576:uxK/cSUHegxG2VBxlYC6l27o0lp+h/tynfCr:uxsm+gQclYCrka+h/tNr
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT.pdf____________________________________________________________________________.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT.pdf____________________________________________________________________________.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail5.planetc.net - Port:
587 - Username:
[email protected] - Password:
623434@esit - Email To:
[email protected]
Targets
-
-
Target
STATEMENT OF ACCOUNT.pdf______________________________________________________________________________________________________.exe
-
Size
974KB
-
MD5
b624b22306191a4001991e6a98a7633c
-
SHA1
f519bef2574df8f8a8d0fc5d19f029c72d9a1182
-
SHA256
a2d18105194e15ef86987c3eba487d3c98e4ffcc9f5df8fff8c2c71559729641
-
SHA512
114151d9dcb4c24168602beb97671dd9e733ab4e49771132ffff18f41d598246b096b751e266347267593539843b0a1967a34547298c1190c2a9626ab1a23edd
-
SSDEEP
24576:uxK/cSUHegxG2VBxlYC6l27o0lp+h/tynfCr:uxsm+gQclYCrka+h/tNr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-