General
-
Target
https://link-target.net/199338/free-perm-and-temp-spoof
-
Sample
240905-agd7tayfqn
Score
10/10
Malware Config
Targets
-
-
Target
https://link-target.net/199338/free-perm-and-temp-spoof
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
AgentTesla payload
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Stops running service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1