General
-
Target
Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs
-
Size
279KB
-
Sample
240419-rg86maed23
-
MD5
5d3834cac11c37e3bdee72fb190f69c7
-
SHA1
ac14ebcd913ea2e2d51a8663127139105a50a810
-
SHA256
5c9f85c6b9a542f488ca18de26cbeb294f86b4e31b61bdbf4ae1cff132d5abf9
-
SHA512
31d6440e3e62dfca9c8144219d52091cf4cd65e806c12ecd5be01839118e9164e68af6750e12c4039cfba8d76a78c7f900f34a5a2eb26ef9fa39cc8ba566c735
-
SSDEEP
6144:LKdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scO9q8phwF1X/:mnS2ImgOcX46l
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
abbafather@myhydropowered.com - Password:
FczQrYLPEFEXumG - Email To:
waymaker@myhydropowered.com
Targets
-
-
Target
Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs
-
Size
279KB
-
MD5
5d3834cac11c37e3bdee72fb190f69c7
-
SHA1
ac14ebcd913ea2e2d51a8663127139105a50a810
-
SHA256
5c9f85c6b9a542f488ca18de26cbeb294f86b4e31b61bdbf4ae1cff132d5abf9
-
SHA512
31d6440e3e62dfca9c8144219d52091cf4cd65e806c12ecd5be01839118e9164e68af6750e12c4039cfba8d76a78c7f900f34a5a2eb26ef9fa39cc8ba566c735
-
SSDEEP
6144:LKdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scO9q8phwF1X/:mnS2ImgOcX46l
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-