Overview

overview

10

Static

static

3

Loader.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    1.6MB

  • Sample

    240628-1czk3asfjh

  • MD5

    53a8f7fcd91f5fe3dd76e22d83709d51

  • SHA1

    9b2c1bdb6d02dc807dcf0185649e9e790ac8226c

  • SHA256

    469796c41aa2ac6c574582a7894179a7f727cc3b7e78a512acf5ce2d2b82f80f

  • SHA512

    910e0d9604583e9f0e1c96962a1988b8b0861031f40a38b3dc48440e8e9680513d9cf4734bb16cac0507087ee41a058bcdce2d7fe4dd1cffd937496e42507daa

  • SSDEEP

    49152:dKTewD+uWhJbH2nHqtp/oNbm0RNzXrgCW5wpKn:dKTt+uAdWnHqtONbm0TbgCWCon

Score
10/10
agenttesladefense_evasionexecutionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      1.6MB

    • MD5

      53a8f7fcd91f5fe3dd76e22d83709d51

    • SHA1

      9b2c1bdb6d02dc807dcf0185649e9e790ac8226c

    • SHA256

      469796c41aa2ac6c574582a7894179a7f727cc3b7e78a512acf5ce2d2b82f80f

    • SHA512

      910e0d9604583e9f0e1c96962a1988b8b0861031f40a38b3dc48440e8e9680513d9cf4734bb16cac0507087ee41a058bcdce2d7fe4dd1cffd937496e42507daa

    • SSDEEP

      49152:dKTewD+uWhJbH2nHqtp/oNbm0RNzXrgCW5wpKn:dKTt+uAdWnHqtONbm0TbgCWCon

    Score
    10/10
    agenttesladefense_evasionexecutionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Window

1
T1564.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks