General
-
Target
Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3.xls.arj
-
Size
143KB
-
Sample
240419-epmldahc5w
-
MD5
5f6781342e82192ccaa0134252301ae2
-
SHA1
1ac83826cb4139bce27b4390152785c7261bbb8a
-
SHA256
917cd281ff0afc3e0d34b0552f5edebe58318f6f468519efcd690d63fdb23fc6
-
SHA512
c98316a56df1371c8579024c352fbac8748ac17c0353989b4e6110602a7cdb94d745f907255008d956d30b2c6a71278ae154fe25cb98690eb0424649e48d4e9c
-
SSDEEP
3072:PTAzOgbNnse01V8XnZiK3B579Rxz7VjLIRPROnOBYBDu8r5lRmghX:PTCO4Nj012XnZf57hF8RoKY1uAlRzX
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
abbafather@myhydropowered.com - Password:
FczQrYLPEFEXumG - Email To:
waymaker@myhydropowered.com
Targets
-
-
Target
Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs
-
Size
279KB
-
MD5
5d3834cac11c37e3bdee72fb190f69c7
-
SHA1
ac14ebcd913ea2e2d51a8663127139105a50a810
-
SHA256
5c9f85c6b9a542f488ca18de26cbeb294f86b4e31b61bdbf4ae1cff132d5abf9
-
SHA512
31d6440e3e62dfca9c8144219d52091cf4cd65e806c12ecd5be01839118e9164e68af6750e12c4039cfba8d76a78c7f900f34a5a2eb26ef9fa39cc8ba566c735
-
SSDEEP
6144:LKdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scO9q8phwF1X/:mnS2ImgOcX46l
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-