Overview

overview

10

Static

static

1

Pepsico RF...12.xls

windows7-x64

10

Pepsico RF...12.xls

windows10-2004-x64

1

Resubmissions

22-05-2024 09:38

240522-lmablaag68 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Pepsico RFQ_P1005712.xls

  • Size

    111KB

  • Sample

    240522-lmablaag68

  • MD5

    9eba63f385b6efcc868f163cc53e5ef6

  • SHA1

    8da5ad24a8a94e035b473f82e03a57740413998d

  • SHA256

    47ee3997168e1d2f64c940453432642e7f7cea124561a40904d7d8d3b58d2b75

  • SHA512

    6c47a8bdfbc30422ab8805fb98f454ee8b71f65057e334a0ee7723a90d2e864efa44b02e98a3984f315222065002d3cb8894b99734807f78045811597207f342

  • SSDEEP

    1536:VU0BRPw/jF2gE+wxQAOhUMqTjfktX/t/qr2ml8Vvygn05kTheDm/:y0WF2F8ATjio2fVvr05ehe

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Pepsico RFQ_P1005712.xls

    • Size

      111KB

    • MD5

      9eba63f385b6efcc868f163cc53e5ef6

    • SHA1

      8da5ad24a8a94e035b473f82e03a57740413998d

    • SHA256

      47ee3997168e1d2f64c940453432642e7f7cea124561a40904d7d8d3b58d2b75

    • SHA512

      6c47a8bdfbc30422ab8805fb98f454ee8b71f65057e334a0ee7723a90d2e864efa44b02e98a3984f315222065002d3cb8894b99734807f78045811597207f342

    • SSDEEP

      1536:VU0BRPw/jF2gE+wxQAOhUMqTjfktX/t/qr2ml8Vvygn05kTheDm/:y0WF2F8ATjio2fVvr05ehe

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks