Overview

overview

9

Static

static

1

b9b4fb770f...6a8.js

windows7-x64

3

b9b4fb770f...6a8.js

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9b4fb770fdb055d474f1a54886bdc380c22afa777a3a0aeaf42a04dcb6a56a8.js

  • Size

    1.8MB

  • Sample

    240507-b2x14aff24

  • MD5

    fffee7bcbf8f724b68d02ebe0c5a133b

  • SHA1

    739696c36214a1a37f382b4da835ba44d2665027

  • SHA256

    b9b4fb770fdb055d474f1a54886bdc380c22afa777a3a0aeaf42a04dcb6a56a8

  • SHA512

    3f2bd2aa6b5cb22aa0c2042fa3af032c83b55f7e5407344cdb502abaf33b3e42d2e0073540226e6a8f3e09f3495ddbc339bfa29a38e420f11583632aa55fe8f4

  • SSDEEP

    768:cNWDuYelMVBbnPOgADSb8O/b64/jWsYOS+Hu8N0RNta7SuHiHwdcU6AH6xgO:JewBbnPOgnh/6OSAuNA6H9AH83

Score
9/10
agilenetexecutionpersistence

Malware Config

Targets

    • Target

      b9b4fb770fdb055d474f1a54886bdc380c22afa777a3a0aeaf42a04dcb6a56a8.js

    • Size

      1.8MB

    • MD5

      fffee7bcbf8f724b68d02ebe0c5a133b

    • SHA1

      739696c36214a1a37f382b4da835ba44d2665027

    • SHA256

      b9b4fb770fdb055d474f1a54886bdc380c22afa777a3a0aeaf42a04dcb6a56a8

    • SHA512

      3f2bd2aa6b5cb22aa0c2042fa3af032c83b55f7e5407344cdb502abaf33b3e42d2e0073540226e6a8f3e09f3495ddbc339bfa29a38e420f11583632aa55fe8f4

    • SSDEEP

      768:cNWDuYelMVBbnPOgADSb8O/b64/jWsYOS+Hu8N0RNta7SuHiHwdcU6AH6xgO:JewBbnPOgnh/6OSAuNA6H9AH83

    Score
    9/10
    executionagilenetpersistence

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects executables packed with Agile.NET / CliSecure

    • Detects executables packed with ConfuserEx Mod

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks