Overview

overview

7

Static

static

Build.exe

windows7_x64

Build.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Build.exe

  • Size

    533KB

  • Sample

    210106-e1z2fwkgzj

  • MD5

    be064c1864b02feab6d41ed1a0ecf2a0

  • SHA1

    be285923433bbd32e8c896bb71910180a15cf61f

  • SHA256

    d2b4d092f178023c22ec781d1ead02de46a5b5b159cc1930220e44d9f1168225

  • SHA512

    4aad663524f7f012c438940040b2a3c0a9e552b5a64306827cb3deb642cacae54ca62a70fa9b2261681f14dfd67feb07eb80e6196b320d8b400f45aa303cb40c

Score
10/10
agentteslaechelondiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Build.exe

    • Size

      533KB

    • MD5

      be064c1864b02feab6d41ed1a0ecf2a0

    • SHA1

      be285923433bbd32e8c896bb71910180a15cf61f

    • SHA256

      d2b4d092f178023c22ec781d1ead02de46a5b5b159cc1930220e44d9f1168225

    • SHA512

      4aad663524f7f012c438940040b2a3c0a9e552b5a64306827cb3deb642cacae54ca62a70fa9b2261681f14dfd67feb07eb80e6196b320d8b400f45aa303cb40c

    Score
    10/10
    agentteslaechelondiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • AgentTesla Payload

      keyloggerstealer

    • Echelon log file

      Detects a log file produced by Echelon.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks