General

  • Target

    SaturnxExternal.exe

  • Size

    7.6MB

  • Sample

    240617-ym1j1awdjm

  • MD5

    39b0f9e3674e8434d552abbf494f5d9f

  • SHA1

    e4d284205e6dc6febc6829980026a6ec08089d75

  • SHA256

    ce02a8c4fed7aefb3da421a2eaffd13fe92495d8701f8016b7cbe946d380b493

  • SHA512

    f27311b90d923dcf364ec6cb674273c681aae874675bb8948a74f69984da8844ec1eb1b31513221e224b370e644d05dff1e4678ba5a7a9065dc78aeca59541dd

  • SSDEEP

    98304:g68jFBO6Y86I/aK0itvOYvIKW8w4avoEeB0EYISxkLwBOIwz8:gxH6FkVzvIT8w4soRpYHxk0BRwz8

Malware Config

Targets

    • Target

      SaturnxExternal.exe

    • Size

      7.6MB

    • MD5

      39b0f9e3674e8434d552abbf494f5d9f

    • SHA1

      e4d284205e6dc6febc6829980026a6ec08089d75

    • SHA256

      ce02a8c4fed7aefb3da421a2eaffd13fe92495d8701f8016b7cbe946d380b493

    • SHA512

      f27311b90d923dcf364ec6cb674273c681aae874675bb8948a74f69984da8844ec1eb1b31513221e224b370e644d05dff1e4678ba5a7a9065dc78aeca59541dd

    • SSDEEP

      98304:g68jFBO6Y86I/aK0itvOYvIKW8w4avoEeB0EYISxkLwBOIwz8:gxH6FkVzvIT8w4soRpYHxk0BRwz8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks