General
-
Target
CMS2227081346258.xlsx
-
Size
212KB
-
Sample
221003-jn93hadhc8
-
MD5
f8084ed9739b92cddbfe398479d986fc
-
SHA1
2d061133057b8a6087713b9a0e5d99d1068056f3
-
SHA256
aea151288c31ea594e45b7cd6a3a060a7177cf095e29ae46837cbefa53a49ac0
-
SHA512
9b29bf093846f421cf92d9d142f21a1cc42add1e22e3dbb686861bb1ca36d9cff308dd1dca76c87bbbe8e25810f5cae6783bdc389ead5b68d69b5c70c0f0d7b4
-
SSDEEP
3072:jNUeGeep8h6FuLmK3aGH/7zbBOnYndd06XwB2eEnSK13U9UniKcUvBUvyzKwhp0W:KempoAGAYnj09BnEnSKU8iV+VzK207u
Static task
static1
Behavioral task
behavioral1
Sample
CMS2227081346258.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CMS2227081346258.xlsx
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.eyeshop.co.za - Port:
587 - Username:
reynoridge@eyeshop.co.za - Password:
eyeS@p0
Extracted
agenttesla
Protocol: smtp- Host:
mail.eyeshop.co.za - Port:
587 - Username:
reynoridge@eyeshop.co.za - Password:
eyeS@p0 - Email To:
xqalloys@gmail.com
Targets
-
-
Target
CMS2227081346258.xlsx
-
Size
212KB
-
MD5
f8084ed9739b92cddbfe398479d986fc
-
SHA1
2d061133057b8a6087713b9a0e5d99d1068056f3
-
SHA256
aea151288c31ea594e45b7cd6a3a060a7177cf095e29ae46837cbefa53a49ac0
-
SHA512
9b29bf093846f421cf92d9d142f21a1cc42add1e22e3dbb686861bb1ca36d9cff308dd1dca76c87bbbe8e25810f5cae6783bdc389ead5b68d69b5c70c0f0d7b4
-
SSDEEP
3072:jNUeGeep8h6FuLmK3aGH/7zbBOnYndd06XwB2eEnSK13U9UniKcUvBUvyzKwhp0W:KempoAGAYnj09BnEnSKU8iV+VzK207u
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-