Overview

overview

10

Static

static

3

Dark.exe

windows10-1703-x64

10

Dark.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Dark.exe

  • Size

    2.2MB

  • Sample

    240829-xjrbgswcpf

  • MD5

    b0c952e0a98835d76da62b3bd4cb7828

  • SHA1

    eb7fb06d56bdf35a8d253debf56b4fad947d5505

  • SHA256

    f722a7285a79f697284d7e376ea3122398c84be2a13eed2b2470ff03d752faad

  • SHA512

    26b1654de14667ed5181e136cf70394f280c85758782e28fae86675e93466602f7fdd3d8c1efd0b4a70bb9ddc8be4e527e45797c433067935062c64465245d7c

  • SSDEEP

    49152:/0X0AsmM6YOcXExsPq2QdGcrkEhsuC06aGHYxKGOoz:/tAsmy/y90V8oHlZ

Score
10/10
agenttesladefense_evasiondiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Dark.exe

    • Size

      2.2MB

    • MD5

      b0c952e0a98835d76da62b3bd4cb7828

    • SHA1

      eb7fb06d56bdf35a8d253debf56b4fad947d5505

    • SHA256

      f722a7285a79f697284d7e376ea3122398c84be2a13eed2b2470ff03d752faad

    • SHA512

      26b1654de14667ed5181e136cf70394f280c85758782e28fae86675e93466602f7fdd3d8c1efd0b4a70bb9ddc8be4e527e45797c433067935062c64465245d7c

    • SSDEEP

      49152:/0X0AsmM6YOcXExsPq2QdGcrkEhsuC06aGHYxKGOoz:/tAsmy/y90V8oHlZ

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojandefense_evasion

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Executes dropped EXE

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks