Overview

overview

10

Static

static

1

e74c7eeb84...82.vbs

windows7-x64

10

e74c7eeb84...82.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97c163bbb028e2bb1439bbe5e9497cfe.bin

  • Size

    17KB

  • Sample

    240330-b1e4wseb6v

  • MD5

    7810c247044c921a143d7c283d89072e

  • SHA1

    c6756595356bdb9d514aee98c842c00bc8d6b719

  • SHA256

    6478cf37ac29da2d308da2fc2e3864bf289221bfc86049a89e7ba5ae6f1bb265

  • SHA512

    41188eb90432e8638b3601a9664e18d7971e3cc0a6d36573950c64006e5aa55318627be7beacbb9544cbdad29b31b6d03640c8a01d62c5881568199367c7da7e

  • SSDEEP

    384:b8oeMX4k+7G2U/h6+mCYix0z/DKoLRw7cY65T/jFLktpN1d66pI:Ak+7aphvsWovY65jStp5G

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982.vbs

    • Size

      37KB

    • MD5

      97c163bbb028e2bb1439bbe5e9497cfe

    • SHA1

      a69c484d867309e1d36f88f0edcca3cb155e25b8

    • SHA256

      e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982

    • SHA512

      64e1444c4862392660ff697805b3817fcb7f5db21cb6a1cb56ed4b4e4e8e10ae067cb6c8b79dbec5a4affeb6d5b618aed0fdd87b92f489be23890236d9e6ff7e

    • SSDEEP

      384:u09gBJmUIWz0AujGKoCJmMuttrW6ku83V3aiHwMgz0YaXBP2a+eGHz4b467QiBAc:u09gBJEWAZGc8NnKwiQxwZY36cuA+yBC

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks