Overview

overview

10

Static

static

3

Shipment _N08925.exe

windows7-x64

10

Shipment _N08925.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Shipment _N08925.zip
  • Size 465KB
  • Sample231026-jzeezafa8s
  • SHA256 98850837371c2fef98480cb45bc98f131bbd0d57445d12093e4c02439def84c9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

C2

  • https://discord.com/api/webhooks/1164647148105769020/8usoHRGoO-AonCx102bzk6qsKGrK-STJRJkdO4oOxLs749SD82CnugdL5-ebUAJQBDcA

Targets

    • Target
      Shipment _N08925.exe
    • Size 788KB
    • SHA256 ea652ce006bdff45184664a2c691ca5c6256fc1a686dfa8721cf5a9d2e1f4593
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslaevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks