General
-
Target
Nghgisxtb.exe
-
Size
407KB
-
Sample
231205-rkjp5sbh23
-
MD5
913aa7a8d382f9195e8057f5592e47a9
-
SHA1
538ea79a057fb8c0bd4f02c697fbefcffef87947
-
SHA256
8879bff7f26b389b8d375928fc6095a3847f8602e00822e3f2f67705e2d85cc0
-
SHA512
ef731541817fac134955e1e5bd632d78e5ac6b3aa9b148b4a5fb6f1acbda91c397a6f21665d91313a9d41ad2973ac0bd26f6784885f061d30d5e139503eb0ba6
-
SSDEEP
12288:vTz+p0qIUakJE3iQ6ZeJfTSK7An9/dhiWSI:vTz+p0qIUakJKixZeZ8/dlS
Static task
static1
Behavioral task
behavioral1
Sample
Nghgisxtb.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
Nghgisxtb.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
^b2ycDldex$@ - Email To:
[email protected]
Targets
-
-
Target
Nghgisxtb.exe
-
Size
407KB
-
MD5
913aa7a8d382f9195e8057f5592e47a9
-
SHA1
538ea79a057fb8c0bd4f02c697fbefcffef87947
-
SHA256
8879bff7f26b389b8d375928fc6095a3847f8602e00822e3f2f67705e2d85cc0
-
SHA512
ef731541817fac134955e1e5bd632d78e5ac6b3aa9b148b4a5fb6f1acbda91c397a6f21665d91313a9d41ad2973ac0bd26f6784885f061d30d5e139503eb0ba6
-
SSDEEP
12288:vTz+p0qIUakJE3iQ6ZeJfTSK7An9/dhiWSI:vTz+p0qIUakJKixZeZ8/dlS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-