General
-
Target
PO-47883678373 pdf.iso
-
Size
642KB
-
Sample
240523-3at9nsda6y
-
MD5
cbded08ab0645023ba5d4f85ba55e490
-
SHA1
c9782e80590a559f6e3dd73ffbfd8aae0d916c4a
-
SHA256
f56471f76edeeb2e85c337cbd2a5e0651992e0c6e24cdf4236e9a44ac92f647a
-
SHA512
848ec053f161602276177cd9d6e208bf4323d25f81d2d660acc902674f9c16a7a91468e622ee0a6a676ac7edad4a25219f3df94d4f7fd852b7bccab1a9d085b5
-
SSDEEP
12288:Uk+S2999kGhptQcuQAnMHaJPpAFyWqWA8q9HigaWR:U9S277tQuuYcuwl9E8
Malware Config
Extracted
Protocol: smtp- Host:
mail.expresscargoes.net - Port:
587 - Username:
[email protected] - Password:
QAZ1234P0#WA
Extracted
agenttesla
Protocol: smtp- Host:
mail.expresscargoes.net - Port:
587 - Username:
[email protected] - Password:
QAZ1234P0#WA - Email To:
[email protected]
Targets
-
-
Target
PO-47883678373 pdf.pif
-
Size
925KB
-
MD5
6970eb348f3d8a5fcde848e45c7968fa
-
SHA1
8e80032aabdcbe17d8b5fa591522e7bddae3a4e4
-
SHA256
61ebd3d4e531342bd9ef4b9ebfeeeccfaca085d4bfa7945cc244aabc6922b250
-
SHA512
f12aa01b95e1b6cc6b65a3c8bf7f064027fcfaf039f61a06a9f846f85b63ef3ed4ea8bd1851118538bfb68ae3c60264f6d8f3c3cce8c3646e00fdcd5c3609d83
-
SSDEEP
12288:8IZ4urk4htbQg6QMdSL+3VhAxkwqW28dtfnn:5Z4uRbQscYy2C/8tfn
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-