Overview

overview

10

Static

static

3

a.exe

windows10-2004-x64

10

Resubmissions

11-11-2023 08:23

231111-j96bfacf5s 10

08-11-2023 14:52

231108-r8x8facc5z 10

27-10-2023 03:52

231027-ee6lhabh8x 10

27-10-2023 03:51

231027-ee1p9abh8s 10

25-10-2023 10:35

231025-mm3htagf6y 10

23-10-2023 09:11

231023-k5l8fahc84 10

21-10-2023 11:53

231021-n2kf8aga32 10

21-10-2023 11:26

231021-njywwsfg64 10

20-10-2023 21:27

231020-1a8qysbe9t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a.exe

  • Size

    5KB

  • Sample

    231021-n2kf8aga32

  • MD5

    800a6337b0b38274efe64875d15f70c5

  • SHA1

    6b0858c5f9a2e2b5980aac05749e3d6664a60870

  • SHA256

    76a7490d3f1b0685f60a417d1c9cf96927b473825a914221f092f82ea112b571

  • SHA512

    bf337140044a4674d69f7a2db30389e248593a99826c8731bc0a5ac71e46819eb539d8c7cbeab48108310359f5604e02e3bd64f17d9fdd380b574f329543645e

  • SSDEEP

    48:6O/tGt28lK9iqmcfaFXfkeLJhyPFlWa8tYb/INV/cpwOulavTqXSfbNtm:j/IUiqtaJkeqDUt5xcpmsvNzNt

Score
10/10
agentteslaredlinexmriginfostealerkeyloggerminerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6564962941:AAEWWFBvCJUfh4ZCVgXTE-QUYajcwLUCJU0/

Targets

    • Target

      a.exe

    • Size

      5KB

    • MD5

      800a6337b0b38274efe64875d15f70c5

    • SHA1

      6b0858c5f9a2e2b5980aac05749e3d6664a60870

    • SHA256

      76a7490d3f1b0685f60a417d1c9cf96927b473825a914221f092f82ea112b571

    • SHA512

      bf337140044a4674d69f7a2db30389e248593a99826c8731bc0a5ac71e46819eb539d8c7cbeab48108310359f5604e02e3bd64f17d9fdd380b574f329543645e

    • SSDEEP

      48:6O/tGt28lK9iqmcfaFXfkeLJhyPFlWa8tYb/INV/cpwOulavTqXSfbNtm:j/IUiqtaJkeqDUt5xcpmsvNzNt

    Score
    10/10
    agentteslaredlinexmriginfostealerkeyloggerminerspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Downloads MZ/PE file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks