Overview

overview

10

Static

static

7

Skou+Multi-Loader.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Skou+Multi-Loader.exe

  • Size

    5.4MB

  • Sample

    240908-dhgk4steng

  • MD5

    5a12c9a8274bdca0b49661ca8a2d031f

  • SHA1

    5433c508da3f3740792dab061228cfb1318d151c

  • SHA256

    438f733d858508c39ae81b7238a7c98232dabc6d389b24e4471c4a16546428a5

  • SHA512

    8d14a9b8e583f69cc82d04dba24bb4a3ecf0253f741cf6c3efb5c7ba5932ee160e2f3a87f43b44b1a6ff3eaac03d454703b3391ab8de294a2bc7fed203643469

  • SSDEEP

    98304:+RHOvLqx0/O4d1f3Z53AlKAdvD7WANTprOhfEQw2uQzjU411IGUmz4k/nqoIX8NV:qHWLo2OcJr3YhdvxNTpqhMMjIGzkk/nr

Score
10/10
agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

Malware Config

Targets

    • Target

      Skou+Multi-Loader.exe

    • Size

      5.4MB

    • MD5

      5a12c9a8274bdca0b49661ca8a2d031f

    • SHA1

      5433c508da3f3740792dab061228cfb1318d151c

    • SHA256

      438f733d858508c39ae81b7238a7c98232dabc6d389b24e4471c4a16546428a5

    • SHA512

      8d14a9b8e583f69cc82d04dba24bb4a3ecf0253f741cf6c3efb5c7ba5932ee160e2f3a87f43b44b1a6ff3eaac03d454703b3391ab8de294a2bc7fed203643469

    • SSDEEP

      98304:+RHOvLqx0/O4d1f3Z53AlKAdvD7WANTprOhfEQw2uQzjU411IGUmz4k/nqoIX8NV:qHWLo2OcJr3YhdvxNTpqhMMjIGzkk/nr

    Score
    10/10
    agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks