General
-
Target
PO-SKT11242201.xls
-
Size
1.0MB
-
Sample
221125-vgtygseh7z
-
MD5
f9abd406f8d2bafbf786c29d2b8d6d90
-
SHA1
6b949183c15d423e071f21d208596f5927081157
-
SHA256
732a1480c447020c0f2fb3050cac80e0dc1067fa212740fe859408ce51f876f7
-
SHA512
fceb298e235991d5347f6d7c51d44a1ab4bcee21b54f6dbd871b9583138a9f28ed949bc2273a8a0d93a0d22ac0ba3f2cbcbaf85e3c5927cb0f56c3f63a80ab97
-
SSDEEP
24576:ir5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXtmyr5XXXXXXXXXXXXUXXXXXXXSXXXXXF:4x
Static task
static1
Behavioral task
behavioral1
Sample
PO-SKT11242201.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO-SKT11242201.xls
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
server196.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
lagos@123 - Email To:
[email protected]
Targets
-
-
Target
PO-SKT11242201.xls
-
Size
1.0MB
-
MD5
f9abd406f8d2bafbf786c29d2b8d6d90
-
SHA1
6b949183c15d423e071f21d208596f5927081157
-
SHA256
732a1480c447020c0f2fb3050cac80e0dc1067fa212740fe859408ce51f876f7
-
SHA512
fceb298e235991d5347f6d7c51d44a1ab4bcee21b54f6dbd871b9583138a9f28ed949bc2273a8a0d93a0d22ac0ba3f2cbcbaf85e3c5927cb0f56c3f63a80ab97
-
SSDEEP
24576:ir5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXtmyr5XXXXXXXXXXXXUXXXXXXXSXXXXXF:4x
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-