ateraagent | 8c4b8c722521e9854efd457d5f62fc1fe1eba34445e47e09568340fb1e9f78b2

Sharing

General

Target
ZOOM 2026 LATEST.zip
Size 39.9MB
Sample260731-cjbwksba68
SHA256 8c4b8c722521e9854efd457d5f62fc1fe1eba34445e47e09568340fb1e9f78b2
MD5 db4a0d7783d65e659d29b2f08da2fe2a
SHA1 beda704adff5c7f5317fc6b2088ee96f77a870d0
SHA512 abf725d23c11dcc510dc515f9382be13022aed339c0bdc7b455a65eda247931db388dc07f358e42584481ddf822c4e57d781d0e46e94b9a6619159a1842b74a5
SSDEEP 786432:L/PI44di7VlGmWBjFiJPMViLi/zHbXYmCGiSKxaqTEJ5FSo3Tb6LPgQF:Lnb4di7WjBhYPMV9/zHE7G6bgJ5N3Ty9
TLSH
T1C897336200550A76E72354674BF35F3BE6D224826D80B48EB81D336E9ED6F1CEDB3621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Android/Google-play.html
- Size 11KB
- SHA256 bb7bdcab7ebc9242aa9987ae98bfa233fe869c02a65e35c0d67ecc1f99596a84
- MD5 6e13ba816be63e5d52b640f61418949f
- SHA1 1c8ac4a4e6d6da6c7ebf8b894546408f2be4e693
- SHA512 4be52fa27fb18cd2bb983b45275da811da157abbedde8c5cf1610531575bc7738fd0acb182b422ef942e2ab085bdcdccec09c67bcc8affd91a120949e4a73fb3
- SSDEEP 192:1qNQUy9hIPAP9n/B46lQwUPlUMkmNEYAk91pBQRGclXGYNQwrN555CNEdo7a+cFb:wpaVfpgEa7a+cFien73
- TLSH
  T1DB327419D640150754378379AFA3978EFBB740238602822D7FEE93514FBA914D6A3FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Android/Install-guide.html
- Size 8KB
- SHA256 3cf6052bd915e697c9e725ac77b27f324469115bf4be0c3ffa193413c399be14
- MD5 4ead556f32f12b76f9303e85e6e33f4a
- SHA1 4f3b3b643d238315b8c00a72d8d3cf59a3f351e8
- SHA512 62c4c4b793d0425ece4d04d0aa12fccb9a9ecb19f499d3910d3643de4f3d0bfc1ae2a26086181eed59753fa0d319fec2aa47e76089220faf0721dae07ce59f59
- SSDEEP 96:nnTaFgizNR/g59pWoKkJsmYZh59xwrgtAIx8A3Xz3iiiD:nnTbizNR/ghDJsmYXzfF3X7iiiD
- TLSH
  T12E02402EA1C151570533D378AFB25609FBC2A153970292AA3EDD124F8FF5A5486A3FCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Android/download.php
- Size 4KB
- SHA256 ebb66b430ed54c98489b3934e5fe8d0f3dd061bdc856886147fca91f377bd2fe
- MD5 7e052d65311b2a77777a98798f9af21a
- SHA1 8a87fc9e33fe4abfa83b45c1604ad6058c469141
- SHA512 6eb36b855ad72b04669cc93f70af79c6817391c91dbe08cd820eaefff9853248c05ede7fa33335951dbf1e84aa128145c2d01e3850d78572ca3050c6ab97b725
- SSDEEP 96:gPirZAye27pEn/4NK/Do/nUiwwXOQauxrnNhAZgaEcTNIwIaAiGU:YE82NE/X/tiOsgLTNNxF
- TLSH
  T1DCA1A6DE207B60299B21E67DDF91AB09F4AA410755229301B87D40CD3FB446CDAF8FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Android/files/ZoomWorkspace.apk
- Size 13.8MB
- SHA256 3391c70cfa1a0081d2d148b70c459f1bec7b2626bd96f1c135ce685ad070963d
- MD5 bfb1c77ba8cbacc45ff06443b2997ca5
- SHA1 70ecebd779acea3728350d07da78cacdb6b58dab
- SHA512 2194798fd689f6748c33f87e9303a260628d88cba1ff73d9b247fcafb79ed62ac748925e754c6e01e1e093fc3d5a9e8e525a46462b411e481c8cd5a81a345aa2
- SSDEEP 393216:esKHopkho6uRviNw6pnRCh8YArG0Mc+Egnu3rWH:esKIpiuNiN3pnRCArGFgrWH
- TLSH
  T136E62342B7860618E8F3CB364A33669563364CB38B13534B6DB13DBCAC73AD497D1A94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

N/A
behavioral7 behavioral8 behavioral9
- Target
  update.apk
- Size 11.8MB
- SHA256 5f7af7ab9dbef4cb8825e6d65cb73ec969d592b49f6a7f476a5115a4f0ada2eb
- MD5 e56aaaa33006a999d43d655997ae16ff
- SHA1 1671e01deddd959e523a4f7fa58ce2cbd46b9388
- SHA512 e09a0098bcd2c62cd27a7ded4c7c8a8f39f12e16bc7d4a00884b083f5df379b5519b04d9fa94fc6d967ddf6a2995da3207d2ccd0158cf17f0f5c8e154b099dfd
- SSDEEP 196608:t7MTuk0ngRzYiT1z7TVmpqyjYd0iYcIN5vmgKNpu47U1EswJ:aCk0ngRcYxdmQHd0d7VmgKPu47c4
- TLSH
  T1FAC60103FB049A5AC0F787F24A3357A126270E678B4357C76960397D7C736D46E8AA8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

N/A
behavioral10 behavioral11 behavioral12
- Target
  Android/index.php
- Size 6KB
- SHA256 2ef8cb14d13154dea730368e01e68f4fd9be1a5f59b805f96bfe6fb680f7db0f
- MD5 42ae345ae01ee7f32f498bca81828ae7
- SHA1 a3ba9a1a45687ea732bcb56c0ab1e542dcf75431
- SHA512 3c5d6f162f67cf9329c3c41a9ff3b977671f19c3fdf3d6de1b01ef6241100cba8d9e865be0c0b8019769bf0f4a215783c50fe38575822a5e8b2b83d307461b77
- SSDEEP 192:VbzuMGXoX6XFdPy5XHiXmsXIXr144xl1se:V/uMGYq1Ny5SWsYke
- TLSH
  T106E161B91118696F0977AF3CF750E304EB96911B0855C021799ECBC11F7621CDBF1EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Device-error.php
- Size 194B
- SHA256 c28c009e485b3d5b32d1b6938c636a2c73dc4f01b220da4e85261b5fe8e90174
- MD5 8b6dd1295ed784c97aa7ec4adbecf1a8
- SHA1 6c769f257f49b238b8f2b31593c9d0ff398a14ea
- SHA512 ea9490f5a956dc0272b02268226b6a988b7e780d6674e11968aef038f7fd9233f37622c41566ec2b68a562a13f2f81f6a64ff187c4e06eabfc78f13eb87b95a1
- TLSH
  T141C0128EA3B028721119D458289A3F5B4B60909F36268948304DC4222F0AA0A5AA7E68
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Iphone/1.php
- Size 6KB
- SHA256 c3dcb833563793a6898c3e8ccb4ec6f4ac273049d84c09641e25e4dae27eb221
- MD5 736b6d5a583e97e7e008f722432b94f5
- SHA1 d341cba04840b9036fe8e21498866bb79a28c5bc
- SHA512 0634842eaed7289e9c307189af841b5fa3196d36d511d89064dd3e2b3abdae874fa024e019c40a3d446c3672f394e4f5fc50a12ab520d9610fb1f6086efb87e2
- SSDEEP 192:VbzuMGXoX6XFdPy5XHiXmsXIXr144xl7w:V/uMGYq1Ny5SWsYq
- TLSH
  T196E181B91108696E0933AF3CF790E304EB96911B0854C021799ECBC12F7621CEBE1EAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Iphone/index.php
- Size 6KB
- SHA256 d8e287e2e7d5921321c25ddb65f6a878001ea0aa4f7389d2e5640a6d0b502e5c
- MD5 822ba4abdf3d6c6d7a4d6ffa299c83af
- SHA1 dab6f695154d21ddc5c06d55fc80404849344ea8
- SHA512 b385c127392449d80f9437698f35b3a532e2f2d57533047e869bb0ca89de3320b03488b570735b22daaf57ae57613c81880254db22c81f2236c4926c7b2b4579
- SSDEEP 192:VbzuMGXoX6XFdPy5XHiXmsXIXr144xluse:V/uMGYq1Ny5SWsYHe
- TLSH
  T1FDE171BA1118696F0973AF3CF750E304EB96911B0865C021799ECBC11F7621CDBF1EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Iphone/invite.html
- Size 3KB
- SHA256 89a2fda7b33ac79a98ed1256dd55504a87c394f31211c246b95a456819b9443f
- MD5 a538c2ec402adc5e5e5c7488eee2f3dc
- SHA1 5853443b8ee9ee4432df0cf17504f96997036e4b
- SHA512 60b7ed683869694e94ee2831868fe3c66597e5ed8b5331a15fad4859a4d1b68979d4a6176fd9c27efc4ef9c1f4c9b69d701096dd7c68c4384d6a760660557edb
- TLSH
  T17161401AA445480A2233D2B47BE15608F7D695234B42DA3A3EEC215F8FF5A4C8593FDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Iphone/sorry.php
- Size 1KB
- SHA256 6e7f7b428d00fe4e693ec8b1cd03ff06496af92c0f58cb22574fff0a125f1f8b
- MD5 66c45665e96d2d7a397b1e18bbf63de4
- SHA1 63c3bfd066a1b1a383da89d89031221f6905396a
- SHA512 3959293941d028fffbf9539eef39cf2790ce55903c0d2c91c0c19127fe1fce2927628e41a590591521a37dd17cc0d2750a44631f05e14ee316a1c0e8ddb6970c
- TLSH
  T18521F00B95C025064333D264AFB69604E7D3C0D782466E15399D224BFFB6208C6E37CE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Windows/download.php
- Size 4KB
- SHA256 3c9e7eae08e819a82e6cece16fb721d049728165e688e906148fef815b14a5d6
- MD5 d1993e9eee4910bc8088fe67ab9a6920
- SHA1 2de97f91a399507134ace4594f2d662045dfd11a
- SHA512 ffb02624a2f33f84df4d8657a24b8ac4b0fe742d8d2311fedd7814de8f74de3f166bc13aeedfbca04c5e2c5f8cdfd1bcaa875520dc2bdcf898a84d42f89b91d6
- SSDEEP 96:gPirZAye27pEn/4NK/Do/nUiwwIOQauxrnNhAZgaEcTNIwIaAiGU:YE82NE/X/t/OsgLTNNxF
- TLSH
  T11DA196DE207B60299B21E67EDF51A705F4A9410755229301B87D40CD3FB446CDAF8FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Windows/files/ZoomWorkspace.msi
- Size 2.9MB
- SHA256 f09550f82262273556f0bf861a598163877d7a5277a05b068db76fc1c13dab56
- MD5 f39a16dc9873d14eb27bcf2fa3916695
- SHA1 f1173113041420a6b51be315e9275b7d09bb966a
- SHA512 cedf268f105ec4e9e47ff8b63cc5e36f89479f5c8f3c0cb8099da70575b79aab2d9c3c3ddc07551eeaf12ca65da5a5eca0cfbffc6c7c2a1be799a630fb8a3649
- SSDEEP 49152:j+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:j+lUlz9FKbsodq0YaH7ZPxMb8tT
- TLSH
  T1D6D523127584483AE37B0A318D7AD6A05E7DFE605B70CA8E9308741E2E745C1AB76F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ateraagent persistence privilege_escalation ransomware rat
- Detects AteraAgent
- Family: AteraAgent
  AteraAgent is a remote monitoring and management tool.
  rat ateraagent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  Windows/index.php
- Size 6KB
- SHA256 24f2f339aa8b31d772840310026ba5f078b025b726aacc77f87b3c36d0eb4933
- MD5 2aa977598792c745badf2223ffece3ac
- SHA1 c67c36fd79850f7d2d68e74651cf49f21f1bd698
- SHA512 73c53c8af507c411f7f0ef54fa37e851247032a59586320b8cfb84f587184641e24e529459ebfe8b7bcc347c19f066f7a32a61d96fff8463ed498155c5d8d869
- SSDEEP 192:VbzuMGXoX6XFdPy5XHiXmsXIXr144xlPse:V/uMGYq1Ny5SWsYqe
- TLSH
  T15EE171B91118696F0973AF3CF750E304EB96911B0865C021799ECBC11F7621CDBF1EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects AteraAgent

Family: AteraAgent

Badlisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30