General
-
Target
SecuriteInfo.com.Heur.25589.9954.xlsx
-
Size
275KB
-
Sample
240125-sy682ahgf5
-
MD5
e108b870cba8e39e516076ca3989372b
-
SHA1
439fd0bdcf0319994f9b91f28d4f2b2a5bde0874
-
SHA256
69f40c2f6a4540550f934e0b2f9a354629d3835b30fd13293c2f6a6b97202159
-
SHA512
710235888d211b49f89d97d2cd32a7ac47922cbe421a3eb0fbb7f50a2b5f2e46236a6b64843cf29e6163c32798b48f46b6e1fca318f8cfc04045f00bf30d244a
-
SSDEEP
6144:5kunhVY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVLOMI2n1WbMS5Fuhix2c:5tC3bVLOMIg9Y
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Heur.25589.9954.xls
Resource
win7-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kabeercommodities.com - Port:
587 - Username:
[email protected] - Password:
w{A6H.o&sz%g - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Heur.25589.9954.xlsx
-
Size
275KB
-
MD5
e108b870cba8e39e516076ca3989372b
-
SHA1
439fd0bdcf0319994f9b91f28d4f2b2a5bde0874
-
SHA256
69f40c2f6a4540550f934e0b2f9a354629d3835b30fd13293c2f6a6b97202159
-
SHA512
710235888d211b49f89d97d2cd32a7ac47922cbe421a3eb0fbb7f50a2b5f2e46236a6b64843cf29e6163c32798b48f46b6e1fca318f8cfc04045f00bf30d244a
-
SSDEEP
6144:5kunhVY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVLOMI2n1WbMS5Fuhix2c:5tC3bVLOMIg9Y
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Abuses OpenXML format to download file from external location
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-