Overview

overview

10

Static

static

10

setup.msi

windows7-x64

10

setup.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup.msi

  • Size

    2.9MB

  • Sample

    241219-bc9nla1jdq

  • MD5

    8840c0ecd1ffd5f1e11ad4e10827888c

  • SHA1

    7ee9366b9e1c5dd00486530aa27933c903693b5f

  • SHA256

    c8ac45f29658c0123fd8933801420645e30cafc5fa836fcbac53066080e05578

  • SHA512

    5af42b6fe53a2422b9301052983bdd950ea29ebd3b38ab986296790a876002b2ba9b466ae0b4e552df169440d3b0652a118347445ebc114addefc80c33f6f2ba

  • SSDEEP

    49152:Q+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:Q+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentdiscoverypersistenceprivilege_escalationrat

Malware Config

Targets

    • Target

      setup.msi

    • Size

      2.9MB

    • MD5

      8840c0ecd1ffd5f1e11ad4e10827888c

    • SHA1

      7ee9366b9e1c5dd00486530aa27933c903693b5f

    • SHA256

      c8ac45f29658c0123fd8933801420645e30cafc5fa836fcbac53066080e05578

    • SHA512

      5af42b6fe53a2422b9301052983bdd950ea29ebd3b38ab986296790a876002b2ba9b466ae0b4e552df169440d3b0652a118347445ebc114addefc80c33f6f2ba

    • SSDEEP

      49152:Q+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:Q+lUlz9FKbsodq0YaH7ZPxMb8tT

    Score
    10/10
    ateraagentdiscoverypersistenceprivilege_escalationrat

    • AteraAgent

      AteraAgent is a remote monitoring and management tool.

      ratateraagent

    • Ateraagent family

      ateraagent

    • Detects AteraAgent

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks