Overview

overview

10

Static

static

3

d2cc943e7f...5c.exe

windows7-x64

1

d2cc943e7f...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2cc943e7fd101b57f31be4dc6241fd6ebb7639f392d2141dd51df96a70b8b5c

  • Size

    1.1MB

  • Sample

    240425-d6gwsaeg7s

  • MD5

    890ad98d344fe4c853ad4ff8dc6f322f

  • SHA1

    9163024beb863ca21b3f2503c702a3b68dccb3f2

  • SHA256

    d2cc943e7fd101b57f31be4dc6241fd6ebb7639f392d2141dd51df96a70b8b5c

  • SHA512

    e096327a94b4993dbba06cb0f40d1a2a863d2adbd8a4901b6fdaf7326ec4eb0693fe082931e6f32412f736ece154a91b4dc6cce397139600010b903a2ac65cb1

  • SSDEEP

    24576:U0QxAr0u9lvY86I7SdsVmtTpu3g7dcDz6NykYYPvlgaE:Ukr0u9lvY8r2+ItTpu3g7dcvuPvlgh

Score
10/10
agentteslaevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7153849678:AAHZ86-INh3Tdo6wZQNFtoJXmAuQIxKFYsc/

Targets

    • Target

      d2cc943e7fd101b57f31be4dc6241fd6ebb7639f392d2141dd51df96a70b8b5c

    • Size

      1.1MB

    • MD5

      890ad98d344fe4c853ad4ff8dc6f322f

    • SHA1

      9163024beb863ca21b3f2503c702a3b68dccb3f2

    • SHA256

      d2cc943e7fd101b57f31be4dc6241fd6ebb7639f392d2141dd51df96a70b8b5c

    • SHA512

      e096327a94b4993dbba06cb0f40d1a2a863d2adbd8a4901b6fdaf7326ec4eb0693fe082931e6f32412f736ece154a91b4dc6cce397139600010b903a2ac65cb1

    • SSDEEP

      24576:U0QxAr0u9lvY86I7SdsVmtTpu3g7dcDz6NykYYPvlgaE:Ukr0u9lvY8r2+ItTpu3g7dcvuPvlgh

    Score
    10/10
    agentteslaevasionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks