General
-
Target
Request for Quotation - P75(D53 )- FATP- RF.xlsx
-
Size
363KB
-
Sample
210920-wvc3kaehd2
-
MD5
6081759506cc8cc4aade4e617b019a1d
-
SHA1
25157cf5fac85a628ad9e60196714623040576d9
-
SHA256
115a683b3b8b8b83c691c3fc65ce2e72db2525db43bd27296ee54e967fe386c6
-
SHA512
91022c8b70840e8a1a24b788afb1516cbe60a3ce51579cd4d7a645d8d3df2cb79df4eb68a918a7fdb4a303204652b1846bb2f88144d18cba10c899ab1f1782ba
Static task
static1
Behavioral task
behavioral1
Sample
Request for Quotation - P75(D53 )- FATP- RF.xlsx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Request for Quotation - P75(D53 )- FATP- RF.xlsx
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
CXXOxCs5
Targets
-
-
Target
Request for Quotation - P75(D53 )- FATP- RF.xlsx
-
Size
363KB
-
MD5
6081759506cc8cc4aade4e617b019a1d
-
SHA1
25157cf5fac85a628ad9e60196714623040576d9
-
SHA256
115a683b3b8b8b83c691c3fc65ce2e72db2525db43bd27296ee54e967fe386c6
-
SHA512
91022c8b70840e8a1a24b788afb1516cbe60a3ce51579cd4d7a645d8d3df2cb79df4eb68a918a7fdb4a303204652b1846bb2f88144d18cba10c899ab1f1782ba
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Neshta Payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
AgentTesla Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-