Overview

overview

10

Static

static

1

Dysmenorrh...1).vbs

windows7-x64

10

Dysmenorrh...1).vbs

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice 24992024.rar

  • Size

    5KB

  • Sample

    240424-gv5egsfd7s

  • MD5

    6e5bcd8722171b948ce711326f7f01fb

  • SHA1

    d98e8a83e3e26720d85036c9bad256908f086114

  • SHA256

    2cfebe0105a8f9ff972dba68b3816658c641bb28d2282ddee6e0e3662e11d674

  • SHA512

    72c7b3c0d4fa4545304fdc92a021f319a5cda5e2dc5def6a4b6a090d5356236e62e4bbc2cf9b781685b993da8a4682b43d8e1d4d3a25cc1e1c6c8c7acdabf10a

  • SSDEEP

    96:esTia6btRT/9op5KQv5Ww4F+RgwuIioakj8As/lfnyr3fSAFMTkvfV/iNEVSBBFC:esma6bt/Cwwu+RFNt4ASAKmFneCSBBdi

Score
10/10
agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.cash4cars.nz
  • Port:
    587
  • Username:
    logs@cash4cars.nz
  • Password:
    logs2024!
  • Email To:
    phillipwhitevirus@gmail.com

Targets

    • Target

      Dysmenorrhoeal (1).vbs

    • Size

      8KB

    • MD5

      e7b23cd53333af14d038cf944e805d06

    • SHA1

      76bc9c6e7c63d79b4ca811b78ad95861e96a4a1c

    • SHA256

      448eddc61303335dbf8e4a2565a3f5dbbe717b2162bb4a08970a4c5d181459aa

    • SHA512

      5dc92e5e1d3be76d79dbdf1dcb015d3c2f93abe01ceb11c71ac401abdb81da2bda3724624a2b735aa82336ecc1fc48f077ece901694987cd15d046e7335b6ba1

    • SSDEEP

      192:d92auEvQW2CZ+denceLymtcXFQqUqPE04rSjPMWdD:7/uEvD2UEepWCxqPcrSjPMu

    Score
    10/10
    agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks