General
-
Target
HSBCMT103.exe
-
Size
629KB
-
Sample
240611-w6lh3sxajr
-
MD5
15997c7f948afd0eed7f14026bb467d9
-
SHA1
6279e8a05c402d0c0c3c2dc072312a0ac896deeb
-
SHA256
22755e217c493b760d41a95afcca9877028556538dfe3f1de100ce9604e0701c
-
SHA512
9ec27a7d3bbbad04da021192920c3fd17654a6c062a97f1e5f433e13fe418616105cd75d9edaba2c0521040fdef156dc9d15bbc6db3e36887c4e45472ce5b14f
-
SSDEEP
12288:DgSMV7+WWM1U1nQX7tRf010rAchscD34XcV/u76kQrO3EzshGRB:BMV7WCj7tzrAwr4Oo6/Ih0
Static task
static1
Behavioral task
behavioral1
Sample
HSBCMT103.exe
Resource
win7-20240508-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
qaxt fhfi ysqm rwcn
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
qaxt fhfi ysqm rwcn - Email To:
[email protected]
Targets
-
-
Target
HSBCMT103.exe
-
Size
629KB
-
MD5
15997c7f948afd0eed7f14026bb467d9
-
SHA1
6279e8a05c402d0c0c3c2dc072312a0ac896deeb
-
SHA256
22755e217c493b760d41a95afcca9877028556538dfe3f1de100ce9604e0701c
-
SHA512
9ec27a7d3bbbad04da021192920c3fd17654a6c062a97f1e5f433e13fe418616105cd75d9edaba2c0521040fdef156dc9d15bbc6db3e36887c4e45472ce5b14f
-
SSDEEP
12288:DgSMV7+WWM1U1nQX7tRf010rAchscD34XcV/u76kQrO3EzshGRB:BMV7WCj7tzrAwr4Oo6/Ih0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-