Overview

overview

10

Static

static

1

httpsgofil...ho.txt

windows10-2004-x64

10

Resubmissions

21-06-2024 18:05

240621-wpjyxssgrq 3

19-05-2024 19:58

240519-ypxk5afa97 10

19-05-2024 19:48

240519-yjgygseh3x 1

19-05-2024 19:17

240519-xzbkzade91 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    httpsgofile.iodntQlho.txt

  • Size

    26B

  • Sample

    240519-xzbkzade91

  • MD5

    beb4937bff161601f6e59c168205d2da

  • SHA1

    c26f4c5c7334eb6184d08adbacbb8fb6a8653ab4

  • SHA256

    215d09d1793ed0f9da71484b97fb12b7d40b0fc0cb5f509e037ed721760c9d96

  • SHA512

    16ab09407a5af59545ef8defb651b13572987bbcfb4fd87fef2de24d977ab3c6e8b7d83e83cb8247fae050724ecea880637b57b2dcc6164279207478b35f4eb5

Score
10/10
adwindagentteslaagilenetdiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      httpsgofile.iodntQlho.txt

    • Size

      26B

    • MD5

      beb4937bff161601f6e59c168205d2da

    • SHA1

      c26f4c5c7334eb6184d08adbacbb8fb6a8653ab4

    • SHA256

      215d09d1793ed0f9da71484b97fb12b7d40b0fc0cb5f509e037ed721760c9d96

    • SHA512

      16ab09407a5af59545ef8defb651b13572987bbcfb4fd87fef2de24d977ab3c6e8b7d83e83cb8247fae050724ecea880637b57b2dcc6164279207478b35f4eb5

    Score
    10/10
    adwindagentteslaagilenetdiscoverykeyloggerpersistencespywarestealertrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Class file contains resources related to AdWind

    • AgentTesla payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

1
T1222

Scripting

1
T1064

Modify Registry

1
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

System Information Discovery

5
T1082

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks