General
-
Target
6ff4d5e331f867bc8bc644ac4b2b38aa7fc796dd13863191fcce3467d5452ad4
-
Size
458KB
-
Sample
231206-dny3caaf43
-
MD5
3c0dd24a7b1fc5ea2f56a8dc771f9960
-
SHA1
b54e184b86b569b3f43ffc2bdd1c55624a50bb84
-
SHA256
6ff4d5e331f867bc8bc644ac4b2b38aa7fc796dd13863191fcce3467d5452ad4
-
SHA512
908b7cd4bb69d19fd0313bc1d11f91cbca6f5d551bc2a744179511c8da2e44df201f612324b5db71b635a095f0e776cf34d0bf4b7702059f546e778cdb066a29
-
SSDEEP
12288:5Tz+p0qIUakJE3iQ6ZeJfTSK7An9/dhiWSI:5Tz+p0qIUakJKixZeZ8/dlS
Static task
static1
Behavioral task
behavioral1
Sample
Nghgisxtb.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
Nghgisxtb.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
^b2ycDldex$@ - Email To:
[email protected]
Targets
-
-
Target
Nghgisxtb.exe
-
Size
407KB
-
MD5
913aa7a8d382f9195e8057f5592e47a9
-
SHA1
538ea79a057fb8c0bd4f02c697fbefcffef87947
-
SHA256
8879bff7f26b389b8d375928fc6095a3847f8602e00822e3f2f67705e2d85cc0
-
SHA512
ef731541817fac134955e1e5bd632d78e5ac6b3aa9b148b4a5fb6f1acbda91c397a6f21665d91313a9d41ad2973ac0bd26f6784885f061d30d5e139503eb0ba6
-
SSDEEP
12288:vTz+p0qIUakJE3iQ6ZeJfTSK7An9/dhiWSI:vTz+p0qIUakJKixZeZ8/dlS
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-