agenttesla

Resubmissions

01-07-2023 10:36

230701-mngyhagf75 10

01-07-2023 10:34

230701-ml5lsagf74 10

01-07-2023 10:31

230701-mkjb6ahg8t 10

01-07-2023 10:19

230701-mc171agf63 10

Sharing

Copy URL

Twitter E-mail

General

Target

NitroRansomware.exe
Size

1.0MB
Sample

230701-mkjb6ahg8t
MD5

67158b9c2184e40339161fddffa9e850
SHA1

5715c4610d84a077de42b5d031ec70ad77a8433e
SHA256

6d65adceb3723db328eac3601cbb540d40bcad7289e98804e977fe24a22d747f
SHA512

617cecfee0d7ad0002cd1fb6782bbadc0642b4513d0b4b195fa94475d774acf8e7a943128ca448bd451573b1642c665b36035adfa12e5ec02cbbdbe4474777a1
SSDEEP

24576:0rYGGjodngwtlaHxN8KUWVe6tw2wvKhLnTU:0rYG2odngwwHv5VbtHw

Score

10^/10

Malware Config

Targets

- Target
  
  NitroRansomware.exe
- Size
  
  1.0MB
- MD5
  
  67158b9c2184e40339161fddffa9e850
- SHA1
  
  5715c4610d84a077de42b5d031ec70ad77a8433e
- SHA256
  
  6d65adceb3723db328eac3601cbb540d40bcad7289e98804e977fe24a22d747f
- SHA512
  
  617cecfee0d7ad0002cd1fb6782bbadc0642b4513d0b4b195fa94475d774acf8e7a943128ca448bd451573b1642c665b36035adfa12e5ec02cbbdbe4474777a1
- SSDEEP
  
  24576:0rYGGjodngwtlaHxN8KUWVe6tw2wvKhLnTU:0rYG2odngwwHv5VbtHw
Score

10^/10

agenttesla nitro evasion keylogger persistence ransomware spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Nitro
  A ransomware that demands Discord nitro gift codes to decrypt files.
  ransomware nitro
- UAC bypass
  evasion trojan
- AgentTesla payload
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Nitro

UAC bypass

AgentTesla payload

Modifies extensions of user files

Adds Run key to start application

Checks whether UAC is enabled

Drops desktop.ini file(s)

Looks up external IP address via web service

Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3