General
-
Target
C0R562212T196210481.eml
-
Size
982KB
-
Sample
240915-x6147syhjh
-
MD5
7f4177e2f181b8733796bbbd83196d8a
-
SHA1
c86f62fe71a5c56cfa62e1b0126503fb0ba314b6
-
SHA256
4c88a0dc99ebcdbad26ad0043fdca24287526f4bb2fe01c6abf6a0bf527606fc
-
SHA512
9813c12a0256cde3c352668571988716564c11077684c28a5ca017eb6e49bc63cb30ccfa3ebdbc3fef8eb4cde94e6366f9590f2b6b35d8025a86d197aa8ee135
-
SSDEEP
24576:28mQhzoRLvj4WWJG5JQAIbr9i5Ohv7egO2iAth:NEIW7hW7gEh
Static task
static1
Behavioral task
behavioral1
Sample
Paymet.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Paymet.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
u;4z3V.Iir1l
Extracted
Protocol: ftp- Host:
ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
u;4z3V.Iir1l
Targets
-
-
Target
Paymet.exe
-
Size
2.5MB
-
MD5
2fd029782f709559adefb235eedbd093
-
SHA1
677219bbd0ab70938a2a658b336418df69c9bb15
-
SHA256
fe03eaf28bc8911f525983a47431e8e4d338a8abc7f2c7833596480ea5eddb02
-
SHA512
c86032f2060a89e82ee32549612d5004d10d23010f3e7647821bac25a05340a381f7e0355be63d8ff7f8ccd4d26a2605dcda3e114bd3471e2497410f6b7e029d
-
SSDEEP
12288:fHPEAmDrpKPtlUM7X1dsUxawC66IHn4Ks6axdNFAzE8l1+/bU5G7AOsS7o:fHPHDUujFC66ge5FMRl1dG7eS7o
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks for VirtualBox Guest Additions in registry
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2