· 6 years ago · Sep 19, 2019, 03:36 AM
1
2* ID: 2324
3* MalFamily: ""
4
5* MalScore: 10.0
6
7* File Name: "AgentTesla_351eb287618799d48f4bdb3225c94029.exe"
8* File Size: 614400
9* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
10* SHA256: "b9e355d367b2d26a2f1f558e1b4e77ac351e2e9b9a7a4bb81acdf104c692b2c2"
11* MD5: "351eb287618799d48f4bdb3225c94029"
12* SHA1: "1594df98665618c97e05be9d3f8545d4a9f19214"
13* SHA512: "8e9b38ef86b0b32147287ef5dcf0a47f7a3a3063f988cf564f39ec0ad708d3ac62b81ba9922dfaab0c67f403127012e9206d7b4f1ca366c7204e52ce023c090a"
14* CRC32: "EE5E5E5F"
15* SSDEEP: "12288:NKx4Jj666+dnSqTGt0a10OCNlKDpOVpeYaQX:No4JJ6+pSqTGt0o5CXAQVbaY"
16
17* Process Execution:
18 "pbXALeMgt79gB.exe",
19 "pbXALeMgt79gB.exe",
20 "services.exe",
21 "svchost.exe",
22 "WmiPrvSE.exe",
23 "lsass.exe",
24 "taskhost.exe",
25 "svchost.exe"
26
27
28* Executed Commands:
29 "\"C:\\Users\\user\\AppData\\Local\\Temp\\pbXALeMgt79gB.exe\"",
30 "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
31 "C:\\Windows\\system32\\lsass.exe",
32 "taskhost.exe $(Arg0)"
33
34
35* Signatures Detected:
36
37 "Description": "Behavioural detection: Executable code extraction",
38 "Details":
39
40
41 "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
42 "Details":
43
44
45 "Description": "Possible date expiration check, exits too soon after checking local time",
46 "Details":
47
48 "process": "pbXALeMgt79gB.exe, PID 2944"
49
50
51
52
53 "Description": "Guard pages use detected - possible anti-debugging.",
54 "Details":
55
56
57 "Description": "The binary likely contains encrypted or compressed data.",
58 "Details":
59
60 "section": "name: .text, entropy: 7.19, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00093000, virtual_size: 0x00092278"
61
62
63
64
65 "Description": "Behavioural detection: Injection (Process Hollowing)",
66 "Details":
67
68 "Injection": "pbXALeMgt79gB.exe(2944) -> pbXALeMgt79gB.exe(624)"
69
70
71
72
73 "Description": "Executed a process and injected code into it, probably while unpacking",
74 "Details":
75
76 "Injection": "pbXALeMgt79gB.exe(2944) -> pbXALeMgt79gB.exe(624)"
77
78
79
80
81 "Description": "Sniffs keystrokes",
82 "Details":
83
84 "SetWindowsHookExW": "Process: pbXALeMgt79gB.exe(624)"
85
86
87
88
89 "Description": "A process attempted to delay the analysis task by a long amount of time.",
90 "Details":
91
92 "Process": "pbXALeMgt79gB.exe tried to sleep 3920 seconds, actually delayed analysis time by 0 seconds"
93
94
95 "Process": "WmiPrvSE.exe tried to sleep 421 seconds, actually delayed analysis time by 0 seconds"
96
97
98
99
100 "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
101 "Details":
102
103 "Spam": "pbXALeMgt79gB.exe (624) called API NtYieldExecution 17153 times"
104
105
106 "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 4841709 times"
107
108
109
110
111 "Description": "Steals private information from local Internet browsers",
112 "Details":
113
114 "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
115
116
117
118
119 "Description": "File has been identified by 41 Antiviruses on VirusTotal as malicious",
120 "Details":
121
122 "MicroWorld-eScan": "Gen:Variant.Midie.66301"
123
124
125 "McAfee": "Fareit-FPZ!351EB2876187"
126
127
128 "Malwarebytes": "Trojan.MalPack.VB.Generic"
129
130
131 "Cybereason": "malicious.866561"
132
133
134 "Arcabit": "Trojan.Midie.D102FD"
135
136
137 "TrendMicro": "TROJ_GEN.R015C0DII19"
138
139
140 "F-Prot": "W32/VBKrypt.SQ.gen!Eldorado"
141
142
143 "Symantec": "ML.Attribute.HighConfidence"
144
145
146 "APEX": "Malicious"
147
148
149 "Paloalto": "generic.ml"
150
151
152 "Kaspersky": "Trojan.Win32.VBKryjetor.chax"
153
154
155 "BitDefender": "Gen:Variant.Midie.66301"
156
157
158 "Avast": "Win32:TrojanX-gen Trj"
159
160
161 "Rising": "Trojan.Injector!1.B459 (CLASSIC)"
162
163
164 "Ad-Aware": "Gen:Variant.Midie.66301"
165
166
167 "Sophos": "Mal/FareitVB-N"
168
169
170 "F-Secure": "Trojan.TR/Kryptik.hfzvw"
171
172
173 "DrWeb": "Trojan.PWS.Banker1.34969"
174
175
176 "Invincea": "heuristic"
177
178
179 "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.jc"
180
181
182 "Trapmine": "malicious.moderate.ml.score"
183
184
185 "FireEye": "Generic.mg.351eb287618799d4"
186
187
188 "Emsisoft": "Gen:Variant.Midie.66301 (B)"
189
190
191 "Ikarus": "Trojan.VB.Agent"
192
193
194 "Cyren": "W32/VBKrypt.SQ.gen!Eldorado"
195
196
197 "Avira": "TR/Kryptik.hfzvw"
198
199
200 "MAX": "malware (ai score=85)"
201
202
203 "Microsoft": "Trojan:Win32/Vbobfus.A!eml"
204
205
206 "Endgame": "malicious (high confidence)"
207
208
209 "ZoneAlarm": "Trojan.Win32.VBKryjetor.chax"
210
211
212 "GData": "Gen:Variant.Midie.66301"
213
214
215 "AhnLab-V3": "Win-Trojan/VBKrypt.RP12"
216
217
218 "Acronis": "suspicious"
219
220
221 "ALYac": "Gen:Variant.Midie.66301"
222
223
224 "Cylance": "Unsafe"
225
226
227 "ESET-NOD32": "a variant of Win32/Injector.EHVD"
228
229
230 "SentinelOne": "DFI - Suspicious PE"
231
232
233 "Fortinet": "W32/GenKryptik.EHBD!tr"
234
235
236 "AVG": "Win32:TrojanX-gen Trj"
237
238
239 "Panda": "Trj/GdSda.A"
240
241
242 "CrowdStrike": "win/malicious_confidence_100% (W)"
243
244
245
246
247 "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
248 "Details":
249
250
251 "Description": "Checks the system manufacturer, likely for anti-virtualization",
252 "Details":
253
254
255 "Description": "Harvests credentials from local FTP client softwares",
256 "Details":
257
258 "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
259
260
261 "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\"
262
263
264 "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml"
265
266
267 "file": "C:\\Users\\user\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini"
268
269
270 "file": "C:\\cftp\\Ftplist.txt"
271
272
273 "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
274
275
276
277
278 "Description": "Harvests information related to installed mail clients",
279 "Details":
280
281 "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
282
283
284 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
285
286
287 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
288
289
290 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
291
292
293 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
294
295
296 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
297
298
299 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
300
301
302 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
303
304
305 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
306
307
308 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
309
310
311 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
312
313
314 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
315
316
317 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
318
319
320 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
321
322
323 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
324
325
326 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
327
328
329 "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
330
331
332
333
334 "Description": "Collects information to fingerprint the system",
335 "Details":
336
337
338
339* Started Service:
340 "VaultSvc"
341
342
343* Mutexes:
344 "Global\\CLR_PerfMon_WrapMutex",
345 "Global\\CLR_CASOFF_MUTEX",
346 "Local\\_!MSFTHISTORY!_",
347 "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
348 "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
349 "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
350 "Global\\.net clr networking",
351 "Global\\F659A567-8ACB-4E4A-92A7-5C2DD1884F72",
352 "Global\\__?_c:_programdata_microsoft_rac_statedata_racdatabase.sdf",
353 "Global\\__?_c:_programdata_microsoft_rac_statedata_racdatabase.sdf:x",
354 "Global\\__?_c:_programdata_microsoft_rac_statedata_racdatabase.sdf:splk:1588",
355 "Global\\4537e4ff-a04e-4b5c-b24d-f967b1d5c02e:sqlce_se_lck:1",
356 "Global\\4537e4ff-a04e-4b5c-b24d-f967b1d5c02e:sqlce_se_lck:2",
357 "Global\\4537e4ff-a04e-4b5c-b24d-f967b1d5c02e:sqlce_se_lck:3"
358
359
360* Modified Files:
361 "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
362 "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
363 "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
364 "C:\\Users\\user\\AppData\\Roaming\\MijR58i4Y5.jpeg",
365 "C:\\Users\\user\\AppData\\Roaming\\Q3U3o53GVy.jpeg",
366 "C:\\Users\\user\\AppData\\Roaming\\IA63wBRhSL.jpeg",
367 "C:\\Users\\user\\AppData\\Roaming\\N0c04Bp0lb.jpeg",
368 "C:\\Users\\user\\AppData\\Roaming\\QLMM9cNJ1O.jpeg",
369 "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
370 "\\??\\WMIDataDevice",
371 "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
372 "C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat",
373 "C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf"
374
375
376* Deleted Files:
377 "C:\\Users\\user\\AppData\\Roaming\\IA63wBRhSL.jpeg",
378 "C:\\Users\\user\\AppData\\Roaming\\N0c04Bp0lb.jpeg"
379
380
381* Modified Registry Keys:
382 "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32",
383 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32\\EnableFileTracing",
384 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32\\EnableConsoleTracing",
385 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32\\FileTracingMask",
386 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32\\ConsoleTracingMask",
387 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32\\MaxFileSize",
388 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\pbXALeMgt79gB_RASAPI32\\FileDirectory",
389 "HKEY_CURRENT_USER\\Software\\Microsoft\\SQMClient\\Reliability\\AdaptiveSqm\\ManifestInfo\\Version"
390
391
392* Deleted Registry Keys:
393
394* DNS Communications:
395
396 "type": "A",
397 "request": "checkip.amazonaws.com",
398 "answers":
399
400
401 "type": "A",
402 "request": "mail.omrussiatours.com",
403 "answers":
404
405
406
407* Domains:
408
409 "ip": "52.55.255.113",
410 "domain": "checkip.amazonaws.com"
411
412
413 "ip": "209.99.16.234",
414 "domain": "mail.omrussiatours.com"
415
416
417
418* Network Communication - ICMP:
419
420* Network Communication - HTTP:
421
422* Network Communication - SMTP:
423
424* Network Communication - Hosts:
425
426* Network Communication - IRC: