Overview

overview

10

Static

static

1

f661588bde...cc.bat

windows7-x64

10

f661588bde...cc.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da503f6a9d9306ac4645857e575e7d3d.bin

  • Size

    4KB

  • Sample

    240426-b9zjwsha91

  • MD5

    74134c96c646c1c5a946a46f9262212b

  • SHA1

    74b3b47bea409aca8f8e0f5fd6744cba2a1a83c9

  • SHA256

    780d2be950f72a22986e202d17108735767c40dfabf05d2c1da4aa0260cd3c30

  • SHA512

    db310a795fc74253ffba29608e3c7085ab601d6b72e8f26c21701beda4ba118169f45a9d22f59ce1eb0956b436b406c2564fd3ca94f11b6746bed6bbc9b6c037

  • SSDEEP

    96:uUjKjKSdf+M9grrsa+8lSJR9TuVVNVdwrLfZAIj5Ht5zwQrCA5Q/3d0VU7:uoSsv+8lChXr9BhH5Q/Ns4

Score
10/10
agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.cash4cars.nz
  • Port:
    587
  • Username:
    logs@cash4cars.nz
  • Password:
    logs2024!
  • Email To:
    officejay@yandex.com

Targets

    • Target

      f661588bdec3197564fa50c785121022bf91774eab1ff79108ecf9404eb0aecc.bat

    • Size

      7KB

    • MD5

      da503f6a9d9306ac4645857e575e7d3d

    • SHA1

      3241d9a60b626a1afa12bdc037066f094d644488

    • SHA256

      f661588bdec3197564fa50c785121022bf91774eab1ff79108ecf9404eb0aecc

    • SHA512

      caec233361b6029bdcffc8cb712083800eaa14dffe4eca2f404eb331a74d9e686634fa5722086de47d3fffd54b62ae7cbcc7a28d95a075f35184975076a55236

    • SSDEEP

      192:yHSonigCNy6+hEkb2DicnznGQ7k7DlKmZoESibXDneDc:g+Fub2fGNlNOH6yc

    Score
    10/10
    guloaderdownloaderagentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks