General
-
Target
b31ab1aa44953eb1e2371a7c4750ab24ac44497ee45244f7fe5940d9280f0ab5.doc
-
Size
327KB
-
Sample
240419-b9ejqadc96
-
MD5
e639a26040e4180f739ee0cd78f65c64
-
SHA1
7f7aee13556a622d65bf1a2387bb74b9e728430b
-
SHA256
b31ab1aa44953eb1e2371a7c4750ab24ac44497ee45244f7fe5940d9280f0ab5
-
SHA512
7455d2bc3739f421eebd52ea4719ae43331833b1897eea7555e54a50876fcc89f4b23153987bbbe96b55277276604f15ce073573da0b86ef5c77e8dfa4dc4b8f
-
SSDEEP
3072:YsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEiC6ghyl7LI9:5KMeKMeKMeKMeKMeKMrC9hyl7LI9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
abbafather@myhydropowered.com - Password:
FczQrYLPEFEXumG - Email To:
waymaker@myhydropowered.com
Targets
-
-
Target
b31ab1aa44953eb1e2371a7c4750ab24ac44497ee45244f7fe5940d9280f0ab5.doc
-
Size
327KB
-
MD5
e639a26040e4180f739ee0cd78f65c64
-
SHA1
7f7aee13556a622d65bf1a2387bb74b9e728430b
-
SHA256
b31ab1aa44953eb1e2371a7c4750ab24ac44497ee45244f7fe5940d9280f0ab5
-
SHA512
7455d2bc3739f421eebd52ea4719ae43331833b1897eea7555e54a50876fcc89f4b23153987bbbe96b55277276604f15ce073573da0b86ef5c77e8dfa4dc4b8f
-
SSDEEP
3072:YsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEiC6ghyl7LI9:5KMeKMeKMeKMeKMeKMrC9hyl7LI9
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Blocklisted process makes network request
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-