Overview

overview

10

Static

static

1

GRAF Ibér...5..vbs

windows7-x64

10

GRAF Ibér...5..vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GRAF Ibérica, Tecnología del Plástico, S.L.U. P.Order 45621748 26085..vbs

  • Size

    38KB

  • Sample

    240326-ppkrwsdb2x

  • MD5

    9a592d05ec8eb4ed0e40584bea35da7d

  • SHA1

    924c99b82b764b77c25be6cf83cd204a283be8d7

  • SHA256

    b0dc753528fac2e75ebae213fad9d05ba85cf9f37858feda945d2eff47979e28

  • SHA512

    3c65b98b4f54cec9012bf40b1716fe3c71843fc850cbc7b395f7f3f47428c6186bc76f701ec19538070ed0f6441261a4ee570e456e72261310d1c716f91316f8

  • SSDEEP

    384:u09gBQzXUIWz0AujGKoCJmMuttrW6ku83V3aiHwDUXNuGQAmQLM6JCuoMOmaU9ao:u09gBQzdWAZGc8NnKwiQoZYRZ1UY2TD

Score
10/10
agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      GRAF Ibérica, Tecnología del Plástico, S.L.U. P.Order 45621748 26085..vbs

    • Size

      38KB

    • MD5

      9a592d05ec8eb4ed0e40584bea35da7d

    • SHA1

      924c99b82b764b77c25be6cf83cd204a283be8d7

    • SHA256

      b0dc753528fac2e75ebae213fad9d05ba85cf9f37858feda945d2eff47979e28

    • SHA512

      3c65b98b4f54cec9012bf40b1716fe3c71843fc850cbc7b395f7f3f47428c6186bc76f701ec19538070ed0f6441261a4ee570e456e72261310d1c716f91316f8

    • SSDEEP

      384:u09gBQzXUIWz0AujGKoCJmMuttrW6ku83V3aiHwDUXNuGQAmQLM6JCuoMOmaU9ao:u09gBQzdWAZGc8NnKwiQoZYRZ1UY2TD

    Score
    10/10
    agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks