General
-
Target
eb433c3cd474e8f546887ac7dccdfc99e2f3e43f49e3c17c8533be4275add793
-
Size
709KB
-
Sample
240522-b4s5xsgc85
-
MD5
8d3355e97dde217c3faf0638c4efebc5
-
SHA1
947efd9dbe3eb27b44063b11c436120dbf55ff0a
-
SHA256
eb433c3cd474e8f546887ac7dccdfc99e2f3e43f49e3c17c8533be4275add793
-
SHA512
d3eec198262da709bc92fe2b051a7a80d0981324a8f955c48876fce7df0437b6632582ca303b37f281a1c3c4bbf287622632dd04086d63ac2fb6a073205279f3
-
SSDEEP
12288:V43M6f15gNVwi6+fOGUsZ0B1C2PVfC99joqN57+2xA/rCDDUzHKLKBsfW2eq:MsvHj8nRC99sqNFyaCHK+SfW2eq
Static task
static1
Behavioral task
behavioral1
Sample
LPO May 21st 2024-PDF.exe
Resource
win7-20231129-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://eu-west-1.sftpcloud.io - Port:
21 - Username:
e8a17a253c4d40b6a0df898aad32f67b - Password:
RugFalv5wDyjeLFrWC25Q2kWCAS6XObb
Extracted
Protocol: ftp- Host:
eu-west-1.sftpcloud.io - Port:
21 - Username:
e8a17a253c4d40b6a0df898aad32f67b - Password:
RugFalv5wDyjeLFrWC25Q2kWCAS6XObb
Targets
-
-
Target
LPO May 21st 2024-PDF.exe
-
Size
744KB
-
MD5
6aa3cad2e92e967768780540a1a78432
-
SHA1
22e6e450889c383af12b571b8e9d83eb9f33c36d
-
SHA256
7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4
-
SHA512
f71bfd535b86391ebd8aa72e4eb1e650e33ca5a1b1ff4740de2589c6896d6c2fd70064d7fcb1a8a4ff7f5826566000ee190766121ff96b4db2ffbea27d8a031e
-
SSDEEP
12288:Gz9n6yWn7fcpVZlu/6uHGedT2shwb201O2nVfW9HjoaN37+2rAfraVDUBWpHfMdg:cn698VVYrH0/RW9HsaNFcouWpHh88
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-