Overview

overview

10

Static

static

10

PowerCheat free.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PowerCheat free.exe

  • Size

    8.0MB

  • Sample

    240612-xxwhcswgja

  • MD5

    63e3124b3360f64808cddb6b5b7dd0b7

  • SHA1

    b5308a58f50c548c66b1c46543537812605b6973

  • SHA256

    3e96e5c7ce88b7a27dbdb0341fe7dc7edd69cfeaba35b7b3019731de8ed81840

  • SHA512

    f57876faf30d4c5e8794bf5e1c70747ca58c629df54f121339cbb6444df2cfa13315952233e32471448b5c919b62147ea70af7d66262ce1658fd9d87cea06f4f

  • SSDEEP

    196608:o/TYUOztYQC4wmOH2dWJMiUb5zBXVnTpkSIgzeRnZYk:kWzupHjJdwbdkSpzYZYk

Score
10/10
agentteslaumbralkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      PowerCheat free.exe

    • Size

      8.0MB

    • MD5

      63e3124b3360f64808cddb6b5b7dd0b7

    • SHA1

      b5308a58f50c548c66b1c46543537812605b6973

    • SHA256

      3e96e5c7ce88b7a27dbdb0341fe7dc7edd69cfeaba35b7b3019731de8ed81840

    • SHA512

      f57876faf30d4c5e8794bf5e1c70747ca58c629df54f121339cbb6444df2cfa13315952233e32471448b5c919b62147ea70af7d66262ce1658fd9d87cea06f4f

    • SSDEEP

      196608:o/TYUOztYQC4wmOH2dWJMiUb5zBXVnTpkSIgzeRnZYk:kWzupHjJdwbdkSpzYZYk

    Score
    10/10
    agentteslaumbralkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks