General
-
Target
1479e1f6338c19e7b0ae37efbda3bcb832c1557850a76d9cafb14c722c547b80
-
Size
699KB
-
Sample
240522-b7x82sgf6y
-
MD5
1f0b689ea6f8047e8ba3c255f9a48f91
-
SHA1
92bd81975134c1e1c3e389ddb17446c70b7b31f7
-
SHA256
1479e1f6338c19e7b0ae37efbda3bcb832c1557850a76d9cafb14c722c547b80
-
SHA512
45c042a208b3abd8d4435eb14f01ea7def9ca347a6a4333c08153a58e0df6770c9f98e9c55369b05242dc8b1835002683f1dd4593183fdd5d5a3d891790c2739
-
SSDEEP
12288:kGnEhVTbFf3B9pd7Zde0T/rHEG2FYncRq86BrDlss/Nn+oXC8gzCAx2b3+m2PfI+:kSqN1Dpd7ZdjstDQrDSsAoX5gupb3+mI
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVICE.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
PAYMENT ADVICE.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: D4v_8+edvC?l. . - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: D4v_8+edvC?l. .
Targets
-
-
Target
PAYMENT ADVICE.exe
-
Size
786KB
-
MD5
e04029c05fb7f8cb31d5a1a0481a18d4
-
SHA1
5dcd8c5d87090ba78e1dc04b576707259e685ff1
-
SHA256
1db2a817de0dffa0c87b4812b079a4103d6c9610dfbad629e9ce1242901ee5e5
-
SHA512
1a1a2375e9cb08f18f032759e0f45e6f6b6c5cf9a53b3f67edc5493dd218db696ae721b0ff7a473e8039b1cc4fcf50e75253cab0d7b4c44ec4fa285018a6e3cc
-
SSDEEP
24576:Tq91zLl7ZXFun3Qr52sAkH5ou133+U2nlZ:mbBZVigrt1H+U4lZ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1