General
-
Target
Commercial Invoice PDF.rar
-
Size
760KB
-
Sample
240426-p1cwesca52
-
MD5
4cf9e356a82317c031ff68bd30ccf944
-
SHA1
0ee5b4ea00e08c181837d4ee63df3a9c7a4b1537
-
SHA256
3a6f6da5183576d9360afba90ea7055507837c0ce5f32699cec8da807c08d1ab
-
SHA512
0bdef1c3e51e539584ea0d11ae0b5af3fb62aebeff5aa03b99bfb5ef645a80f938f5c272963c2175bf82305034705090d03062648e17defd6de3b3698f683baf
-
SSDEEP
12288:CXywjWHz41z7+0TKtRjMqPsHIH0uOhnnlpFAMr5H+/5+VZKuGvkSgPAuu/WvQTRA:uywjWT+7EPsHIHvcnl3AyH+howJcSZuP
Static task
static1
Behavioral task
behavioral1
Sample
Commercial Invoice PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Commercial Invoice PDF.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.fascia-arch.com - Port:
587 - Username:
brian@fascia-arch.com - Password:
HERbertstown1987 - Email To:
donj5425@gmail.com
Targets
-
-
Target
Commercial Invoice PDF.bat
-
Size
822KB
-
MD5
5a12438b3b4c926c12a9376c7bf13426
-
SHA1
c3185c6a5e5f07a5befbe4af7131d05634f5d1a3
-
SHA256
1a794211deaa0ecb6abc6101d7c1bd61111b4dd2d895ee7ecf78fbf17f4c9ab3
-
SHA512
16c1e0e18eb8b3345b8b05443b782cb1dd35492ac986811c39f3cdce8dfe85b003aba029ffca0e38aa33c951d0d08281825152b0e239471eac3de18ac67864d0
-
SSDEEP
12288:tEqnHvjNIrpf9rN/mc/CaBmIwsyaPSIir97G6NLOZCGKEgbjuPBB5uO12rq:txPjKr5BNDWVxcSIiRG6atlB5N
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1