General
-
Target
20240128_678833-Hesap - TL Özeti.pdf.exe
-
Size
847KB
-
Sample
240701-mep8hsyhrm
-
MD5
fe5d4da9b40dbb8d7e87cbe36b35b68d
-
SHA1
a32438e13f0834cd0fec5335f88994e22050401f
-
SHA256
88fc5d96ebc31042f41c8d80e87a1d6b8c4fabe33f11717dbf417f969604af70
-
SHA512
1f887ec149fbced0e92213ed417a8459029307388725ec04d2e7b1120a482e63e0381ccb1f2d642c49dfa8a84318a5d196a0e3f7c862254471a61f7bec41f0af
-
SSDEEP
12288:c/EE8GILjWLWgHeBoH4vzEe94RRIMMRRc+VhDKujWhNqdgfQOlFutTM7b:RcHBY4eX8+VhBWh0WQQ8
Static task
static1
Behavioral task
behavioral1
Sample
20240128_678833-Hesap - TL Özeti.pdf.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
20240128_678833-Hesap - TL Özeti.pdf.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.musabody.com - Port:
587 - Username:
[email protected] - Password:
MUSAbody_victoria2018 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.musabody.com - Port:
587 - Username:
[email protected] - Password:
MUSAbody_victoria2018
Targets
-
-
Target
20240128_678833-Hesap - TL Özeti.pdf.exe
-
Size
847KB
-
MD5
fe5d4da9b40dbb8d7e87cbe36b35b68d
-
SHA1
a32438e13f0834cd0fec5335f88994e22050401f
-
SHA256
88fc5d96ebc31042f41c8d80e87a1d6b8c4fabe33f11717dbf417f969604af70
-
SHA512
1f887ec149fbced0e92213ed417a8459029307388725ec04d2e7b1120a482e63e0381ccb1f2d642c49dfa8a84318a5d196a0e3f7c862254471a61f7bec41f0af
-
SSDEEP
12288:c/EE8GILjWLWgHeBoH4vzEe94RRIMMRRc+VhDKujWhNqdgfQOlFutTM7b:RcHBY4eX8+VhBWh0WQQ8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-