General
-
Target
BL copy PDF.rar
-
Size
760KB
-
Sample
240426-s9xtqsfg5z
-
MD5
a22771da1b634d78656fabc6788d9fda
-
SHA1
5c08f0e27fc91ccf20086d95122af27c886aa2ea
-
SHA256
16a15febf0467c21e09bbec34a1ac6c4ef59e9398620005a72c8de22b9d177ca
-
SHA512
2a740f1c3285a3738f5fc2eb03e1d347deb75bf655cccaadd48d3f865f18c5d9757984ad1849a1c8d98ef87744bcb5ecd3f93d664fda92c63e6798c695a4efc5
-
SSDEEP
12288:NXywjWHz41z7+0TKtRjMqPsHIH0uOhnnlpFAMr5H+/5+VZKuGvkSgPAuu/WvQTR0:xywjWT+7EPsHIHvcnl3AyH+howJcSZux
Static task
static1
Behavioral task
behavioral1
Sample
BL copy PDF.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
BL copy PDF.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.fascia-arch.com - Port:
587 - Username:
brian@fascia-arch.com - Password:
HERbertstown1987 - Email To:
donj5425@gmail.com
Extracted
Protocol: smtp- Host:
mail.fascia-arch.com - Port:
587 - Username:
brian@fascia-arch.com - Password:
HERbertstown1987
Targets
-
-
Target
BL copy PDF.bat
-
Size
822KB
-
MD5
5a12438b3b4c926c12a9376c7bf13426
-
SHA1
c3185c6a5e5f07a5befbe4af7131d05634f5d1a3
-
SHA256
1a794211deaa0ecb6abc6101d7c1bd61111b4dd2d895ee7ecf78fbf17f4c9ab3
-
SHA512
16c1e0e18eb8b3345b8b05443b782cb1dd35492ac986811c39f3cdce8dfe85b003aba029ffca0e38aa33c951d0d08281825152b0e239471eac3de18ac67864d0
-
SSDEEP
12288:tEqnHvjNIrpf9rN/mc/CaBmIwsyaPSIir97G6NLOZCGKEgbjuPBB5uO12rq:txPjKr5BNDWVxcSIiRG6atlB5N
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1