Overview

overview

10

Static

static

10

160d67508f...f4.msi

windows7-x64

10

160d67508f...f4.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1237a9140ac0333e8f4dff131a18635e.bin

  • Size

    2.6MB

  • Sample

    241109-bdke4ateqf

  • MD5

    9832536e9e8e646f94a12e9abbc5c5a5

  • SHA1

    f0d95cef9b827798190ce80ba1c0a2760956f59f

  • SHA256

    d403ec1cb843a83bc8f08ab393486010ec5de28263e2ca21bbe20a44e633d8d7

  • SHA512

    7d2338a0ac84699d4b3e246e045233ad11315a5ae54c3ab956369c25e35db40d15558275c3d5a2a498dc26828a84d0e9a2277ab81264eb7c4b7815c9efb97a6f

  • SSDEEP

    49152:YewvczZvQLlHSnqo2Fg/eYbi9pZWzroF3NA0RCy5S+ekABUnurY4fblp0:YilvAlHScg/3W9p24VkycPPY4H0

Score
10/10
ateraagentdiscoverypersistenceprivilege_escalationrat

Malware Config

Targets

    • Target

      160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4.msi

    • Size

      2.9MB

    • MD5

      1237a9140ac0333e8f4dff131a18635e

    • SHA1

      ad0621265080d50c2e6f56d6a87a53a448d8d8dd

    • SHA256

      160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4

    • SHA512

      9c5f8621941eac95a00bc2aa8e23ec372a63994b61f287d90777a90c22c9557481fd5bfbb5cb621d2da9a11ae5b623dd73d27dc792842731a5d8f2ba03666742

    • SSDEEP

      49152:F+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:F+lUlz9FKbsodq0YaH7ZPxMb8tT

    Score
    10/10
    ateraagentdiscoverypersistenceprivilege_escalationrat

    • AteraAgent

      AteraAgent is a remote monitoring and management tool.

      ratateraagent

    • Ateraagent family

      ateraagent

    • Detects AteraAgent

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks