General

  • Target

    hesaphareketi-01.pdf.7z

  • Size

    625KB

  • Sample

    231208-tl12xsahhm

  • MD5

    b0d2693a1e38fde7cc5c5a718e9e25a6

  • SHA1

    ef88eafaeee979d378dfb2e907a0a37d9fd6f8c8

  • SHA256

    b7ec04f0752b11ad21f33b8528f5292de675ece3d979fb0f513f8febf7479edb

  • SHA512

    1d569186290dbb18e52fe3899cd546450f6e129ebba89267c2f670c8f76991f6190df26d519207b4fad67800a74fd1743061db9a14c223437162a880c485ab87

  • SSDEEP

    12288:vPUehRXFhDMJ0NqTI0sWJvgtJG4s+SPZQ1DswniaGFsB2BYij6LoSjf:1ThQJ0NqkLWNgtI4srQdniaF9ySb

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      hesaphareketi-01.pdf.exe

    • Size

      675KB

    • MD5

      a31452fd58c3e120006a7dfd3f7fd88e

    • SHA1

      672f98fff52ff2a6b14a955e945a623b1f7a518c

    • SHA256

      129865eb4a51fe06e9843260e1380be012fae638c3f150ea9f9f52e505627111

    • SHA512

      ea5b32c6de668d179228ef817fe7f51f4d2946c8a54abcd33487ec088a0fde99d6f8151614ffe627a38118bb60c8982d87b3a271f743644488ec431d8fdcff36

    • SSDEEP

      12288:hhkZ5GrHrhDM102xTI0iWPkajbICsxSW1Q1DPwdiyGLYS8+Yid6tojjj:hK/UrhQ102xkZWMajUCslQidiyWcmjX

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks