ateraagent | 71b6e6f6794082358219ac554eeed7c0cc9ac2a061fe307d131414426ec22aaf

General

Target
setup.msi
Size 2.9MB
Sample260528-an6weaby6m
SHA256 71b6e6f6794082358219ac554eeed7c0cc9ac2a061fe307d131414426ec22aaf
MD5 42362d7ba9a5572bb790a676abee7332
SHA1 7285da4ff8ede74795d1eb3f53f1a7a2b6a41fc5
SHA512 2a227c0aa6f0128fe2e3ea7df2eff046e89af029c85e5deb1c2a6879eaa1458ce014d77bdf68aa0decbba5ea36030be0c0064191ec2b26c8a817d488fac12957
SSDEEP 49152:tVmZ/rUroTJVyqlSjZro4BPPV5qFWh00UEk5hL0n5Qw0YWfxxWvZgkj:tVQIrOVyjroSNR00UE9n5D0YWfxwv
TLSH
T1E4E52301B4D0403AEABF0E319A76CA709EBDFE741B50C54E9358794D2E70A809776BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.msi
- Size 2.9MB
- SHA256 71b6e6f6794082358219ac554eeed7c0cc9ac2a061fe307d131414426ec22aaf
- MD5 42362d7ba9a5572bb790a676abee7332
- SHA1 7285da4ff8ede74795d1eb3f53f1a7a2b6a41fc5
- SHA512 2a227c0aa6f0128fe2e3ea7df2eff046e89af029c85e5deb1c2a6879eaa1458ce014d77bdf68aa0decbba5ea36030be0c0064191ec2b26c8a817d488fac12957
- SSDEEP 49152:tVmZ/rUroTJVyqlSjZro4BPPV5qFWh00UEk5hL0n5Qw0YWfxxWvZgkj:tVQIrOVyjroSNR00UE9n5D0YWfxwv
- TLSH
  T1E4E52301B4D0403AEABF0E319A76CA709EBDFE741B50C54E9358794D2E70A809776BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution ateraagent persistence privilege_escalation ransomware rat spyware trojan
- Detects AteraAgent
- Family: AteraAgent
  AteraAgent is a remote monitoring and management tool.
  rat ateraagent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2