Overview

overview

10

Static

static

1

PONO6188.vbs

windows7-x64

10

PONO6188.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7cfc5403ba2334a0a7e851e612c61ea89c6e6e1e36e756700e512adbeca10cf.gz

  • Size

    28KB

  • Sample

    240427-bzxmjsgc82

  • MD5

    8c9a8a88ada0df4ba50abf70fae1a780

  • SHA1

    29d772ddf6f8cbdee6a9db023e2a49dfa8fe1059

  • SHA256

    b7cfc5403ba2334a0a7e851e612c61ea89c6e6e1e36e756700e512adbeca10cf

  • SHA512

    5500829862dcb67c8113cd03c8066473dd5e4d9e163a09afc1e969d869b5cad3a8991ccea7cdd53ffc92d9c47d4054539ce642bf12d656414e4d2e725fc776c6

  • SSDEEP

    768:ZhQaKkMJJb4Stp2Rtk6hoSpwliPSuxNnzF:4aVGt4Ru6hozliPD

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.concaribe.com
  • Port:
    21
  • Username:
    koko@concaribe.com
  • Password:
    2ogFj^8ECV(?

Targets

    • Target

      PONO6188.vbs

    • Size

      59KB

    • MD5

      3c00879a0e4e4a7d7b78bb8611bcc94f

    • SHA1

      3ddd2f54b7fb54df60134318515fd61b119bc46f

    • SHA256

      94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f

    • SHA512

      4dfce826cf9f7456dd981b4a1b4c985d75c9c849434a94c5987bd08fe037217b5160441e23072c498b5e9c93e2d00d8c6e814ea1736e68724aa461881ab1b31c

    • SSDEEP

      1536:cdukLI1gPDPTxyk0MfFCNqnlAEfen8TCQr:Yukk1gPDJzoGaEWn8Tv

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks