Overview

overview

10

Static

static

10

Guna.UI2.dll

windows7-x64

1

Guna.UI2.dll

windows10-2004-x64

1

Loader.exe

windows7-x64

3

Loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader V8.rar

  • Size

    14.3MB

  • Sample

    240523-2dg8vabc75

  • MD5

    63082effd90e9df9029a93e71d750a51

  • SHA1

    e0f1d7678d6bd4c09dc706759879e1c21d549735

  • SHA256

    ecace832b0e30b5a54e6af43bd5a990ba0ffd4ecd549b6ca6597332f073579e3

  • SHA512

    03a96212b1b9b4bf41cf2092362953634c4a4d7b98a1d1265f27ee8e27795d733e2dc658f33c2f03e009da392ee40c474f2696f232e142f7f3b319dde29f13cf

  • SSDEEP

    393216:7LvZWVmMbSOCZzG5KaDy1NqumrBknduQ3FS24N9+V3:fvQIMb2ZzMxuckUQ3j09g

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Guna.UI2.dll

    • Size

      2.1MB

    • MD5

      c19e9e6a4bc1b668d19505a0437e7f7e

    • SHA1

      73be712aef4baa6e9dabfc237b5c039f62a847fa

    • SHA256

      9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82

    • SHA512

      b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de

    • SSDEEP

      49152:6QNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckYf+Yh/FJ3:6Ahck2z

    Score
    1/10
    behavioral1behavioral2

    • Target

      Loader.exe

    • Size

      30.5MB

    • MD5

      6f6d0e09fae7de66a3547c93dd3e7c97

    • SHA1

      e42a226083e178e9d40bb0c52ece216ee7e48627

    • SHA256

      a216b785458dfab3b50cb6203d486eeeb23938b34df97da29ac60a306c4668ae

    • SHA512

      d2644ebe5bac6632e7e3ef6626b38af742be1e1cc56b163dd4edf3910857383949bc7e05f1b78037c1191c1f22d158e896a4b2b850bef8485f47fceeca89f7e1

    • SSDEEP

      786432:8S9UdJ7EOnWdQb/0cVWXXS9UdJ7EOnWdQb/0cVW:8S9UH7EOWd6/fCS9UH7EOWd6/f

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks