agenttesla | f1f3466784f8757113fa3fc2f742b04202cb98cfa3e92f1b26c001bfcff2d207 | Triage

Sharing

General

Target

f1f3466784f8757113fa3fc2f742b04202cb98cfa3e92f1b26c001bfcff2d207
Size

139.7MB
Sample

240707-bfp4csyhlp
MD5

ab32fa6aaaf27e833cc65317b8fd6e98
SHA1

61b339765f53729fcd5a6631e7ef833de9dccad0
SHA256

f1f3466784f8757113fa3fc2f742b04202cb98cfa3e92f1b26c001bfcff2d207
SHA512

5338550de90d654400ed051670ef3670f17c3279777fab65da9a4afd87caffeac8466b5700b58ef99e3c627959c87c3a4db5a9a0dfa34a8afa9387e3cf402271
SSDEEP

786432:wMBFPmYEDLVqSOqZDq+ybW1h4uyrzMVX9yvjBIA1toV+dUbWN3KPqiVslIBKOMxT:wRYcLQvqkWLYUNw91toV+dgTVBZo

Score

10^/10

agenttesla blackguard persistence privilege_escalation

Malware Config

Targets

- Target
  
  f1f3466784f8757113fa3fc2f742b04202cb98cfa3e92f1b26c001bfcff2d207
- Size
  
  139.7MB
- MD5
  
  ab32fa6aaaf27e833cc65317b8fd6e98
- SHA1
  
  61b339765f53729fcd5a6631e7ef833de9dccad0
- SHA256
  
  f1f3466784f8757113fa3fc2f742b04202cb98cfa3e92f1b26c001bfcff2d207
- SHA512
  
  5338550de90d654400ed051670ef3670f17c3279777fab65da9a4afd87caffeac8466b5700b58ef99e3c627959c87c3a4db5a9a0dfa34a8afa9387e3cf402271
- SSDEEP
  
  786432:wMBFPmYEDLVqSOqZDq+ybW1h4uyrzMVX9yvjBIA1toV+dUbWN3KPqiVslIBKOMxT:wRYcLQvqkWLYUNw91toV+dgTVBZo
Score

7^/10

persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

agentteslablackguard

behavioral1

behavioral2

persistenceprivilege_escalation