General

  • Target

    Skelly V2.exe

  • Size

    2.5MB

  • Sample

    240520-bjasvach71

  • MD5

    b1262cd5f134c61ba3b077f309a843b8

  • SHA1

    edaa655070619975f80590ffbd1cfab0c74c678f

  • SHA256

    1a8da34980844838bce5efb93589edfd9c1a0a3d7243534544938c236f656c1d

  • SHA512

    9daf4325e148a52f586f4649f53b8b965f62d80f47c8fe69bab4d2f6f3324e2f3420b88972dc0c7714d8dfa844cea476024482a3fd7c9cb464e0969e45404219

  • SSDEEP

    49152:V92xyXxkYR0RXagDvjWj+0gR8NIpYc7s6cLVSUrRvUkM1Ku6bOOQ:z2xy+YzgHI+0gi2Yc7vcLM5su6K7

Malware Config

Targets

    • Target

      Skelly V2.exe

    • Size

      2.5MB

    • MD5

      b1262cd5f134c61ba3b077f309a843b8

    • SHA1

      edaa655070619975f80590ffbd1cfab0c74c678f

    • SHA256

      1a8da34980844838bce5efb93589edfd9c1a0a3d7243534544938c236f656c1d

    • SHA512

      9daf4325e148a52f586f4649f53b8b965f62d80f47c8fe69bab4d2f6f3324e2f3420b88972dc0c7714d8dfa844cea476024482a3fd7c9cb464e0969e45404219

    • SSDEEP

      49152:V92xyXxkYR0RXagDvjWj+0gR8NIpYc7s6cLVSUrRvUkM1Ku6bOOQ:z2xy+YzgHI+0gi2Yc7vcLM5su6K7

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks