Overview

overview

10

Static

static

7

04995df8cb...e2.exe

windows7-x64

10

04995df8cb...e2.exe

windows10-2004-x64

10

14b162eed3...66.elf

debian-12-armhf

1

2cba66d97b...d8.exe

windows7-x64

10

2cba66d97b...d8.exe

windows10-2004-x64

10

2f84a18564...bc.elf

debian-12-armhf

1

620c15ed6f...8a.elf

ubuntu-20.04-amd64

10

623f93cf91...c8.wsf

windows7-x64

8

623f93cf91...c8.wsf

windows10-2004-x64

8

70932cac71...1a.elf

debian-12-armhf

1

CAHKHCM2404009CFS.exe

windows7-x64

10

CAHKHCM2404009CFS.exe

windows10-2004-x64

10

a552331bbe...60.elf

ubuntu-20.04-amd64

9

b9d1e862b5...f4.exe

windows7-x64

10

b9d1e862b5...f4.exe

windows10-2004-x64

4

Michelines.ps1

windows7-x64

8

Michelines.ps1

windows10-2004-x64

8

f601a6e5b8...bc.elf

debian-12-armhf

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b555b98abe8eb8f9e9f240fdb22070df16680e8864a6d93549a8288f57bff5c7

  • Size

    3.2MB

  • Sample

    240424-bp6gpsdf32

  • MD5

    085ebb577d4392f3951592da1e78689e

  • SHA1

    d765cca25fb9d7519313ad1e07d3909b3c0f82a7

  • SHA256

    b555b98abe8eb8f9e9f240fdb22070df16680e8864a6d93549a8288f57bff5c7

  • SHA512

    8f351ad99cf5866de27f0f7168f0f79f704a1c5aebde8880b10aaf07727893f418001e70a3072fedefe4c736fece50c155dd3b46be1117cd9151e4e80c33a7db

  • SSDEEP

    98304:fHd/1gLeEz8PgPRMPMoGePXy+OutxPnLaMg:Dg1PMPX9PiHkxP2Mg

Score
10/10
agentteslaguloadermiraibotnetdiscoverydownloaderkeyloggerlinuxpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.saleo-gomel.by
  • Port:
    587
  • Username:
    ogt@saleo-gomel.by
  • Password:
    Q_gidroadmin_2014
  • Email To:
    zamanic62@gmail.com

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.saleo-gomel.by
  • Port:
    587
  • Username:
    ogt@saleo-gomel.by
  • Password:
    Q_gidroadmin_2014

Extracted

Family

mirai

C2

spagetti.openproxylist.info

Targets

    • Target

      04995df8cbeb0877d5721b8edecaf7d48154b17f8d0bfa61860beba48e30e0e2.exe

    • Size

      701KB

    • MD5

      190da3f2954e4c817a3ee720d5bf10f7

    • SHA1

      1bc2d3f6661de4653dc05f7d36cb53810be8b136

    • SHA256

      04995df8cbeb0877d5721b8edecaf7d48154b17f8d0bfa61860beba48e30e0e2

    • SHA512

      7864e1ade3fa97c79565b8b464eec5eb8afe54b51fc38417dcbb2922bc0e55e05fb1cd3f84ec4fd0aed2cbbfc32ddce6ddbf370744c1dca01b052e464039330e

    • SSDEEP

      12288:1kVE996u+hbON8WBzdgeb4kjklEn8lLVJLy9dnJDHOWFy:sEP6n0hzdgebD4P+9tJDNy

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      14b162eed3f3f592b5bb6b6b86e817a81834301ce1fe3500a7c328e041a81f66.elf

    • Size

      56KB

    • MD5

      4a4918771d934ff309164274607c2205

    • SHA1

      322f493d728a7129d62226c79f460ac5db371c36

    • SHA256

      14b162eed3f3f592b5bb6b6b86e817a81834301ce1fe3500a7c328e041a81f66

    • SHA512

      53a8ff980e952b16a38f8bf60e1aad7ef0db880e91e67c80a9a0de44e6df00817a083b409f4922fb9e6e35828994514d059f9461e261d7f486bee389a6d8417c

    • SSDEEP

      1536:JXJd/HuM7TaI2eSYZffwlmwubPXzpyQvVwRUL0ztn56TrT/XD:BJxnP2eSI3wkwopdVwRUL0ztnwnLD

    Score
    1/10
    behavioral3

    • Target

      2cba66d97b8af051072417ad7267c9f56f8f74eca98a5e5bf5d7ddc894249ad8.exe

    • Size

      852KB

    • MD5

      15f196c8858b2d1475159aec13f4fb32

    • SHA1

      2b11a170e73e552b1899911257e0414b81660e61

    • SHA256

      2cba66d97b8af051072417ad7267c9f56f8f74eca98a5e5bf5d7ddc894249ad8

    • SHA512

      ab4d5f10202038712ca2e81fd78dbc89fe96b8a23e2bd442ad22b1d658b5520a8a63243966abbf30803cee7a6104f55dad10f63714db170cb07d4e01fa12fe7d

    • SSDEEP

      24576:25hHMCcDBudIWS+FgLYrD5jxX7jaE1P1q:ahHXG8hS+FICLj8

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral4behavioral5

    • Target

      2f84a18564ad0853e8c4853a610c42df170a3c0e50316ad65931201a727ff9bc.elf

    • Size

      31KB

    • MD5

      b27eeb84b54c3cbbefd7eed086097c86

    • SHA1

      b8b1c4f53e531a867d95aac5c87dd577cfa81799

    • SHA256

      2f84a18564ad0853e8c4853a610c42df170a3c0e50316ad65931201a727ff9bc

    • SHA512

      25bf88566b537e61e0b567c61b66898f901c268c407d304f555bc2039355b5e13c1deaa02e02feb70cb5778bfcf8b693f6551e17f7450b69ea157480bcd735a7

    • SSDEEP

      768:gjbVGaxbvqj/XGzTDuq53BLU6IauljrKEToAks3UozQ:gjBq/2zTXrLIjj8ABzQ

    Score
    1/10
    behavioral6

    • Target

      620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a.elf

    • Size

      29KB

    • MD5

      d15e0d59fb573bd3fed0126bf434b982

    • SHA1

      01a748696ac1eb2b85a8297ead29af408ef3f017

    • SHA256

      620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a

    • SHA512

      983d42704a79f664d44c6712bb8dc608a29a96cf1b0211dd9c4cc6a7ccd59c04c10f57a077033ca53df08cde90efe11957ee721c4d4a5388c27a695dc31ae7d0

    • SSDEEP

      768:5KpROfidrsa6Uq4sn9Fp1Sr+OqDUM8sH9o+eI:5Kpk6doaxun0+OqD/8s2+V

    Score
    10/10
    miraibotnet

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Traces itself

      Traces itself to prevent debugging attempts

    • Writes file to system bin folder

    behavioral7

    • Target

      623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf

    • Size

      55KB

    • MD5

      6d2058cda28b4285006c69ce86422b00

    • SHA1

      e438dc30c51de576537c87eb60d2c3a656f41687

    • SHA256

      623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8

    • SHA512

      67a50f0e2ea180f5acd2de2467a52161c29b91040f56c1acc8a4c31dc4d6000c3cf7b93252a7df2d38b747b7c689570b988ee3f9371c44267dba7388c48e9701

    • SSDEEP

      768:YXf54p2p/fwNaKj7gHrI0i3wPDPM+A0s2hyOX0Q4afFysrmUYAYB8nq7r/Iaw0FU:Yx9ukLI1gPDPTxyk0MfFCNqngIaweU

    Score
    8/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral8behavioral9

    • Target

      70932cac7130ce1561e74c534ba8db2589880a9858bd5b1de4683745576d1b1a.elf

    • Size

      59KB

    • MD5

      09a461ceb48ed902e5d9c22ea5692943

    • SHA1

      e77f355d1ed30f6d5e7eedfb0dd89bc96056c08a

    • SHA256

      70932cac7130ce1561e74c534ba8db2589880a9858bd5b1de4683745576d1b1a

    • SHA512

      678f29b911b562f487794f07d56a2167f7825e7301c04d0bee1217d1034de4dd36046830555745b6122fc15591bd5c801ad7d61590817ce34b2ec8b01caa1f16

    • SSDEEP

      768:8YBgs2VF9NFitelxSUWru4fNDpHeGXfO+ybDgVNIhIxeC+rs+4cqbJ6lftm6bEUO:6LiWSZruIoJJtpaP7u/aTvotJDvt

    Score
    1/10
    behavioral10

    • Target

      CAHKHCM2404009CFS.exe

    • Size

      852KB

    • MD5

      15f196c8858b2d1475159aec13f4fb32

    • SHA1

      2b11a170e73e552b1899911257e0414b81660e61

    • SHA256

      2cba66d97b8af051072417ad7267c9f56f8f74eca98a5e5bf5d7ddc894249ad8

    • SHA512

      ab4d5f10202038712ca2e81fd78dbc89fe96b8a23e2bd442ad22b1d658b5520a8a63243966abbf30803cee7a6104f55dad10f63714db170cb07d4e01fa12fe7d

    • SSDEEP

      24576:25hHMCcDBudIWS+FgLYrD5jxX7jaE1P1q:ahHXG8hS+FICLj8

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral11behavioral12

    • Target

      a552331bbed7ca8a92633b6fcac504884d8a7bc54ce60618dd936f4aa8625560.elf

    • Size

      54KB

    • MD5

      a3f694379bc9b8147d862cd7a57f3b1a

    • SHA1

      a31790391ade668346d6979c65943773fd90555e

    • SHA256

      a552331bbed7ca8a92633b6fcac504884d8a7bc54ce60618dd936f4aa8625560

    • SHA512

      f14cde76efa44fcec825ea8484a5e258568d55493d16c80eb97818f92916e6a7be3e0e0196361c6488f7759d8096730ce698033c7e96b027af9cf41381861059

    • SSDEEP

      768:/QgRhU/v00xWDzhluvag0RCdxe77us+bvK8f06Z9krq0ucz3TkBqIW:EWDNlyazRCXevuLK8f0frq0uH0

    Score
    9/10
    discovery

    • Contacts a large (237775) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral13

    • Target

      b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe

    • Size

      1.1MB

    • MD5

      a0e9d68e9a8541eb30d6a31cae4a942b

    • SHA1

      3cae987132d7f45df56f77c1ff2a542cb64e64c0

    • SHA256

      b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4

    • SHA512

      eebfe98652f6b7dffb7e57bdd73c80c073f0f1879ee8a86c17054e1e1ecc3bf5dcec66b4619944659b9038ecfca19254fec0cb60c5264d905382acc8fb0ea03a

    • SSDEEP

      24576:c0vvQvOM6sjFYk6IuhdTuvMJbmhQU/YydIE5Ltp:clvpN2zuvMxmhB/Ylyp

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral14behavioral15

    • Target

      Michelines.All

    • Size

      56KB

    • MD5

      82340892cba1f6e4faaa080bb634cf9c

    • SHA1

      56b029cbcada747897e9beff7c8f1013b8c9b6ce

    • SHA256

      a03bb54517df231824d324ad20b79094efef9af20eff855e30a6f459bcc43912

    • SHA512

      dfea5297d9aef9004af38f8604e74313f99d477199e797dbeec5367ec3e6c0000a4c62eeab54425deee14de5b1adb224f09956a10619cf03b821b2b91b84f5c7

    • SSDEEP

      1536:aY1v3JTUB3Z1un5G97KwaJx8NIodV4kIj+1S78:auBUEnY7za0NIMa+k8

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral16behavioral17

    • Target

      f601a6e5b8d78c1f32dbf5fe2cd18cee7ac598cd35fb7aba60526f4df95271bc.elf

    • Size

      52KB

    • MD5

      132dcf4085f03bbde2db0212febc839b

    • SHA1

      c1a666122eebef75969d77f5b44221551f021b6c

    • SHA256

      f601a6e5b8d78c1f32dbf5fe2cd18cee7ac598cd35fb7aba60526f4df95271bc

    • SHA512

      52f658e9baa2df4a8b37fa6483886674c838a7e411e5eee03de9f8d917ea87842280d1594c7684e19f850d0519c55e4dee50e868f7de7be9a2152994ee445a44

    • SSDEEP

      768:yUS3LZKF1NYoeLMfl3q3Eg+Sz1QBGTnE4FV9T3GEUF2vtaM9o6ZDtDRvy2g:yz38Fnda3Eg+oE4FvhGlQRo2g

    Score
    1/10
    behavioral18

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

2
T1053

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Scheduled Task/Job

2
T1053

Hijack Execution Flow

1
T1574

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Scheduled Task/Job

2
T1053

Hijack Execution Flow

1
T1574

Defense Evasion

Modify Registry

5
T1112

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

6
T1012

System Information Discovery

9
T1082

Remote System Discovery

1
T1018

Network Service Discovery

2
T1046

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

upx
Score
7/10

behavioral1

agentteslakeyloggerspywarestealertrojan
Score
10/10

behavioral2

agentteslakeyloggerspywarestealertrojan
Score
10/10

behavioral3

Score
1/10

behavioral4

agentteslakeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral5

agentteslakeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral6

Score
1/10

behavioral7

miraibotnet
Score
10/10

behavioral8

Score
8/10

behavioral9

Score
8/10

behavioral10

Score
1/10

behavioral11

agentteslakeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral12

agentteslakeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral13

discovery
Score
9/10

behavioral14

guloaderdownloaderpersistence
Score
10/10

behavioral15

Score
4/10

behavioral16

persistence
Score
8/10

behavioral17

persistence
Score
8/10

behavioral18

Score
1/10