General
-
Target
RNSM00382.7z
-
Size
54.2MB
-
Sample
241103-2b6hnawhll
-
MD5
8987d1fde10958b9677cda33b17284db
-
SHA1
66c676f2322cfd073f7f44243e3c44a36f4d410a
-
SHA256
a37af0c7a5b3bdb3d30a80161f5e5ab17716f8521baf5ea215e0447e4615c58f
-
SHA512
bcb1e572ef6c7aac22cbf2f7f9419ac691e8dbf03e64b4134f84797310f1e37078e65a40906ec34e6c3d995988f80661f2cd7a55fbd956fbacddf2f8e7ff7e89
-
SSDEEP
1572864:alZnkO0GGY+PPoAXGqK9L39pBwQR7fgbuEmgBTllW5:mZkHa1QWzXWuEmalli
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00382.7z
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.4mdesignltd.com - Port:
587 - Username:
[email protected] - Password:
=B?HZb=ZeB^C
Extracted
C:\Users\Admin\3D Objects\077532-readme.html
avaddon
Extracted
C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\A4AA9-Readme.txt
netwalker
Targets
-
-
Target
RNSM00382.7z
-
Size
54.2MB
-
MD5
8987d1fde10958b9677cda33b17284db
-
SHA1
66c676f2322cfd073f7f44243e3c44a36f4d410a
-
SHA256
a37af0c7a5b3bdb3d30a80161f5e5ab17716f8521baf5ea215e0447e4615c58f
-
SHA512
bcb1e572ef6c7aac22cbf2f7f9419ac691e8dbf03e64b4134f84797310f1e37078e65a40906ec34e6c3d995988f80661f2cd7a55fbd956fbacddf2f8e7ff7e89
-
SSDEEP
1572864:alZnkO0GGY+PPoAXGqK9L39pBwQR7fgbuEmgBTllW5:mZkHa1QWzXWuEmalli
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon family
-
Detected Netwalker Ransomware
Detected unpacked Netwalker executable.
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Netwalker family
-
AgentTesla payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
3Clear Persistence
1File Deletion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1