Overview

overview

10

Static

static

7

Burgies+Fr...+1.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Burgies+Free+Temp+1.exe

  • Size

    6.1MB

  • Sample

    240829-dv4w6s1erd

  • MD5

    2d39790330e84baeb49b0703b529b8b1

  • SHA1

    5f782112dddcc6c949a05d93415a007823a43f08

  • SHA256

    559edbe0910c66ecf21bb766dd14dc30f1db8153379c72410d4a88623611e477

  • SHA512

    fa21704ec51978fcd88af78afb7332a508364fc04d4ab297dd76483aa12fa57911d60d6d19212b9bbec47c28f6373aa29a306681f2dfa50140081e3466b8ac41

  • SSDEEP

    98304:kF4FpDrHCezJxEi4dPkxtF0Ix2DlxjILMC6kXDTGPW5S3jT+ff+sX3iiZokdnT:k+5CKkViPFN6fPyS32fd3tokp

Score
10/10
agenttesladiscoveryevasionkeyloggerpersistencespywarestealerthemidatrojan

Malware Config

Targets

    • Target

      Burgies+Free+Temp+1.exe

    • Size

      6.1MB

    • MD5

      2d39790330e84baeb49b0703b529b8b1

    • SHA1

      5f782112dddcc6c949a05d93415a007823a43f08

    • SHA256

      559edbe0910c66ecf21bb766dd14dc30f1db8153379c72410d4a88623611e477

    • SHA512

      fa21704ec51978fcd88af78afb7332a508364fc04d4ab297dd76483aa12fa57911d60d6d19212b9bbec47c28f6373aa29a306681f2dfa50140081e3466b8ac41

    • SSDEEP

      98304:kF4FpDrHCezJxEi4dPkxtF0Ix2DlxjILMC6kXDTGPW5S3jT+ff+sX3iiZokdnT:k+5CKkViPFN6fPyS32fd3tokp

    Score
    10/10
    agenttesladiscoveryevasionkeyloggerpersistencespywarestealerthemidatrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks