General
-
Target
Legacy IV - V1.1.exe
-
Size
6.1MB
-
Sample
240727-a83pgsygpe
-
MD5
80d067daa15cf171657c489d7f68d09b
-
SHA1
e975906cee540584cb9f578fceecfb69a0033bdf
-
SHA256
4b00df9227e8b12fb3d48dddf07b649a3f1e55910e4b1d6267eaecb2ec711558
-
SHA512
2c52986fd56d534c99a217f222829082ea59fea9643abac44db027fa49f324ca7e48136effc46a2156524f3c8d9e7f1b31c9ac37e925e036a526ab9ff792bbc1
-
SSDEEP
98304:R9MsBy2TA+QjoTGRouTWV8K7nqe4Jpzz68j2UUEnQqKUK4DyNDPVzFcWCTi:HMCA+QMTGRovhqw4U3U0DZFcWCT
Behavioral task
behavioral1
Sample
Legacy IV - V1.1.exe
Resource
win7-20240708-en
Malware Config
Targets
-
-
Target
Legacy IV - V1.1.exe
-
Size
6.1MB
-
MD5
80d067daa15cf171657c489d7f68d09b
-
SHA1
e975906cee540584cb9f578fceecfb69a0033bdf
-
SHA256
4b00df9227e8b12fb3d48dddf07b649a3f1e55910e4b1d6267eaecb2ec711558
-
SHA512
2c52986fd56d534c99a217f222829082ea59fea9643abac44db027fa49f324ca7e48136effc46a2156524f3c8d9e7f1b31c9ac37e925e036a526ab9ff792bbc1
-
SSDEEP
98304:R9MsBy2TA+QjoTGRouTWV8K7nqe4Jpzz68j2UUEnQqKUK4DyNDPVzFcWCTi:HMCA+QMTGRovhqw4U3U0DZFcWCT
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1