General
-
Target
a17759c06b57c853de4253ad2b94023c_JC.bin
-
Size
768KB
-
Sample
230901-tvha6sfh3z
-
MD5
c0f1d38592cde486d46ebd6ad768ab73
-
SHA1
8ecc7146d12d00debd07dfeaf05edf3377533dff
-
SHA256
b108a3fdf6e3b31ef521c9d44314d7ed97bbf0b5ddf2e1572ade860239a8d152
-
SHA512
0c7d8f557f90e079111955fbac5322609e341daa71531606703fcbd5c4847df1622b031ad37c649048ab6f57a01e02863299dfb61f03aaf2f90868f77bc481cb
-
SSDEEP
24576:s11P9jPZ9ZZoTj7tUSN1oe12XxekMBCHT:s111Hwj7taCKx/McHT
Malware Config
Extracted
Protocol: smtp- Host:
mail.gskm.com.my - Port:
587 - Username:
[email protected] - Password:
GSKM11051996
Extracted
agenttesla
Protocol: smtp- Host:
mail.gskm.com.my - Port:
587 - Username:
[email protected] - Password:
GSKM11051996 - Email To:
[email protected]
Targets
-
-
Target
Ningbo - Invoices - Past Due.exe
-
Size
1.4MB
-
MD5
6d330cfc2b1f041da05b1198916e3286
-
SHA1
1e80df2a55cc8edab1d7d8eb3e27679c7b1d16ca
-
SHA256
6a18f19993096ed7c6b70fdac1a9d7d1faf756928edd6af4f4bcc6b92edb8f1f
-
SHA512
56414d5ff7e1a16763d023d009e6f382fda884189cdf7aa0a0b17f26ea3daea21c27004910af85fd3927395d538b36d1931abafa83d75c949f11e25d3bed17c0
-
SSDEEP
12288:Md/Tf2iN25iSWrG4/D5MI0Pzkf6EXaifNUXZdWlpdmixVgjkBdOAg+rtmgVYx+Dt:M1Tf1+63/AilKZkcYVgjWNgoVY3E
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-