General
-
Target
SKYHIGH SW -- 6TH SOA.cab
-
Size
365KB
-
Sample
210421-yh59zx9pja
-
MD5
42c1fc3188f993589afe25eef9382a53
-
SHA1
8ccc058c38bdab9f62faba6552fb5ca3b1c3fcd0
-
SHA256
2df59e76e095243c70dbe7637549590a61d06865f965ff8ae675762e8e2b6a0a
-
SHA512
4243880d142c47d0fbfe650e6d1600d1f18e0c3fa4263632f4b32608bf76580f2a6704a5525527dc5061abb5dac858897fa56984a6bf6c4173947a93542758f8
Static task
static1
Behavioral task
behavioral1
Sample
SKYHIGH SW -- 6TH SOA.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SKYHIGH SW -- 6TH SOA.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.hyshippingcn.com - Port:
587 - Username:
plogs112@hyshippingcn.com - Password:
e*u@qkS4
Targets
-
-
Target
SKYHIGH SW -- 6TH SOA.exe
-
Size
477KB
-
MD5
0bbd4f88ffc0e2403dc677db55138705
-
SHA1
96969cad9fb63258840273415b56524e7e0dd44e
-
SHA256
4e03a6064d48718f91df9160b73f9a8cba2976bf516e6f97dc0ec1ddf2c05633
-
SHA512
71972eb34f862212faf2c90da28526aa7af502e3b32453bc9b3c4fefb52ceb50823f4da4003003f3527f87d41bf357e8adf2c84d22b3394aeac1d078df620e15
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Nirsoft
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-