Overview

overview

10

Static

static

1

Urgent Order #PDF.js

windows10-2004-x64

10

Urgent Order #PDF.js

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    07082026_1334_06082026_Urgent Order #PDF.zip
  • Size 550KB
  • Sample260807-qvlf2swfmg
  • SHA256 f557f2011e72c6e236db44f3e620d5b856f3bd2566ff06a4ab7c67399a3460cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
agentteslacollectiondefense_evasiondiscoveryexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials
  • Protocol

    ftp
  • Host

    ftp://ftp.4bagh.net
  • Port

    21
  • Username

    [email protected]
  • Password

    CarpeDiem.2024

Targets

    • Target
      Urgent Order #PDF.js
    • Size 2.1MB
    • SHA256 5fc8146428d65afc46a1138d4fd7f9cf50b3f1afcbe444659dc6e29cf60b1679
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

    • Family: AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • ConfuserEx .NET packer

      Detects ConfuserEx .NET packer.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks