General
-
Target
ac54c568fc2bfe2851a49e58150286a42a37d4d2ce782e73d163f2ec60e646ed.gz
-
Size
692KB
-
Sample
240522-r4c2pseg8w
-
MD5
e20d2e805d85b04e540c0dda744564b5
-
SHA1
fa44807b7eb6c4bae650244a9962bcf4eeb841aa
-
SHA256
ac54c568fc2bfe2851a49e58150286a42a37d4d2ce782e73d163f2ec60e646ed
-
SHA512
30addd3ec50ee5cdb2b741428b3a350831eea91424bd4a31ee41818531d213250ecd72d55f2c7dea71a31bd2b8c393a0a9b43a3db9c3aa7a390f072b6eedd425
-
SSDEEP
12288:nKE5+TG4BS5cveVUVjftMitqexd7oUepaXpp2sDHBusvmEqYZfTL7:nKECBS5YOAtq5aKsDxvmEqYZ/
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents & bill of Lading_PDF.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Shipping documents & bill of Lading_PDF.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.deblokhoeve.be - Port:
587 - Username:
[email protected] - Password:
Blokhoeve2490.i
Extracted
agenttesla
Protocol: smtp- Host:
mail.deblokhoeve.be - Port:
587 - Username:
[email protected] - Password:
Blokhoeve2490.i - Email To:
[email protected]
Targets
-
-
Target
Shipping documents & bill of Lading_PDF.exe
-
Size
768KB
-
MD5
aa2e0331db7bdc7c4a51a4d9ca2f4832
-
SHA1
fc6ee67838401e8cbcef4e2c547d06cb56f12628
-
SHA256
f0e352c3fbf73706c4c0fd2e118cf10b241dd880b58ceb67491b585fa5719fad
-
SHA512
42c7e114bd9fa67301724481c893bfaa95ec633b53328d157b95e26fe6c4ca29e29cbda5ac0bcc73577865d18d4c3875fc2c08f6747f4ec926868e41c20957c3
-
SSDEEP
12288:+IeWET/mr9K+22BEEzFatnhghS5+v+DUVNf5MWl0axTbo+i1Cv7z2CjH8mri7jY3:OWtb3BEMhS5qOk5SVC+CjcmWg
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1