Overview

overview

10

Static

static

New order ...B).xls

windows7-x64

10

New order ...B).xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New order RI325-10-2022_final_order(129KB).xls

  • Size

    152KB

  • Sample

    221025-mtz19scdc9

  • MD5

    b99df40dde85ab1824f89e8a5fbd14b3

  • SHA1

    885f04d2cb924bcd883ff93bf44460d035c0371d

  • SHA256

    d688e37de999f16478d723616c16b19311f01bea844b17970be30ad2fc3209ff

  • SHA512

    b4656530416425be1e648a09ef55f91113f883471bd6e1483800f84fda56392020b6b6f8be5615d2dba5cb3809658181ffbbec4c4627dbbc295808c4e859164a

  • SSDEEP

    3072:LjTI89ImhyKUX8/+S5caheFP6DcTCC3BH8ITRtM1FXdoxwdiUzWuC:PTLIpvdSPheh6D8BH8QgFXixwd

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      New order RI325-10-2022_final_order(129KB).xls

    • Size

      152KB

    • MD5

      b99df40dde85ab1824f89e8a5fbd14b3

    • SHA1

      885f04d2cb924bcd883ff93bf44460d035c0371d

    • SHA256

      d688e37de999f16478d723616c16b19311f01bea844b17970be30ad2fc3209ff

    • SHA512

      b4656530416425be1e648a09ef55f91113f883471bd6e1483800f84fda56392020b6b6f8be5615d2dba5cb3809658181ffbbec4c4627dbbc295808c4e859164a

    • SSDEEP

      3072:LjTI89ImhyKUX8/+S5caheFP6DcTCC3BH8ITRtM1FXdoxwdiUzWuC:PTLIpvdSPheh6D8BH8QgFXixwd

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks