Overview

overview

10

Static

static

1

httpsgofil...ho.txt

windows10-2004-x64

10

Resubmissions

21/06/2024, 18:05

240621-wpjyxssgrq3

19/05/2024, 19:58

240519-ypxk5afa9710

19/05/2024, 19:48

240519-yjgygseh3x1

19/05/2024, 19:17

240519-xzbkzade9110

Sharing

Copy URL Twitter E-mail

General

  • Target
    httpsgofile.iodntQlho.txt
  • Size 26B
  • Sample240519-xzbkzade91
  • SHA256 215d09d1793ed0f9da71484b97fb12b7d40b0fc0cb5f509e037ed721760c9d96
  • MD5 SHA1 SHA512
Score
10/10
adwindagentteslaagilenetdiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target
      httpsgofile.iodntQlho.txt
    • Size 26B
    • SHA256 215d09d1793ed0f9da71484b97fb12b7d40b0fc0cb5f509e037ed721760c9d96
    • MD5 SHA1 SHA512
    Score
    10/10
    adwindagentteslaagilenetdiscoverykeyloggerpersistencespywarestealertrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Class file contains resources related to AdWind

    • AgentTesla payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks