Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * ID: 1651
- * MalFamily: "AgentTesla"
- * MalScore: 10.0
- * File Name: "AgentTesla_bb0cb63cd1f24f666217be9405090016.exe"
- * File Size: 1278464
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "77f5d8bbf5b22a43f60bcc4ded7dbc56529fa0ba00b29e916132bddbeae3ca26"
- * MD5: "bb0cb63cd1f24f666217be9405090016"
- * SHA1: "78b7c961ac2f719330fce0901fca454a37ae1fbd"
- * SHA512: "b2639317f54b721b262106e0ce9dcd4b92871c4115f3b43357f83f52e329c8de9581a2c69393f53dd13ad728f4d229892966d4e9dd909cbb71a64b624773b646"
- * CRC32: "AFE43057"
- * SSDEEP: "24576:LAHnh+eWsN3skA4RV1Hom2KXMmHaUWYyIgMRFDlbqNOeEG5A5:mh+ZkldoPK8YaAJFRFDBIOeE/"
- * Process Execution:
- "7uggFmh2cagM.exe",
- "RegAsm.exe",
- "services.exe",
- "svchost.exe",
- "WmiPrvSE.exe",
- "lsass.exe",
- "taskhost.exe",
- "taskhost.exe",
- "WMIADAP.exe"
- * Executed Commands:
- "\"C:\\\\\\\\Windows\\\\\\\\Microsoft.NET\\\\\\\\Framework\\\\\\\\v2.0.50727\\\\\\\\RegAsm.exe\"",
- "C:\\Windows\\system32\\lsass.exe",
- "taskhost.exe $(Arg0)"
- * Signatures Detected:
- "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
- "Details":
- "Description": "Behavioural detection: Executable code extraction",
- "Details":
- "Description": "Guard pages use detected - possible anti-debugging.",
- "Details":
- "Description": "A process attempted to delay the analysis task.",
- "Details":
- "Process": "RegAsm.exe tried to sleep 851 seconds, actually delayed analysis time by 0 seconds"
- "Process": "WmiPrvSE.exe tried to sleep 301 seconds, actually delayed analysis time by 0 seconds"
- "Description": "Reads data out of its own binary image",
- "Details":
- "self_read": "process: 7uggFmh2cagM.exe, pid: 1576, offset: 0x00000000, length: 0x00010000"
- "self_read": "process: 7uggFmh2cagM.exe, pid: 1576, offset: 0x00000000, length: 0x00138200"
- "Description": "The binary likely contains encrypted or compressed data.",
- "Details":
- "section": "name: .rsrc, entropy: 7.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0006dc00, virtual_size: 0x0006dabc"
- "Description": "Sniffs keystrokes",
- "Details":
- "SetWindowsHookExW": "Process: RegAsm.exe(1760)"
- "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
- "Details":
- "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 13743916 times"
- "Description": "Steals private information from local Internet browsers",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
- "Description": "Installs itself for autorun at Windows startup",
- "Details":
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\0x433A5C55736572735C7362755C417070446174615C636D737470"
- "data": "C:\\Users\\user\\AppData\\cmstp\\chgusr.bat"
- "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
- "Details":
- "MicroWorld-eScan": "Trojan.AutoIt.Agent.XS"
- "Qihoo-360": "HEUR/QVM10.1.D51F.Malware.Gen"
- "McAfee": "Artemis!BB0CB63CD1F2"
- "CrowdStrike": "win/malicious_confidence_90% (W)"
- "BitDefender": "Trojan.AutoIt.Agent.XS"
- "Invincea": "heuristic"
- "Cyren": "W32/Autoit.G.gen!Eldorado"
- "ESET-NOD32": "a variant of Win32/Injector.Autoit.EHD"
- "APEX": "Malicious"
- "Paloalto": "generic.ml"
- "GData": "Trojan.AutoIt.Agent.XS (2x)"
- "Kaspersky": "HEUR:Trojan.Win32.Generic"
- "Alibaba": "Trojan:Win32/AutoitInject.544c07ce"
- "Endgame": "malicious (high confidence)"
- "F-Secure": "Heuristic.HEUR/AGEN.1043182"
- "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.tc"
- "FireEye": "Generic.mg.bb0cb63cd1f24f66"
- "Emsisoft": "Trojan.AutoIt.Agent.XS (B)"
- "F-Prot": "W32/Autoit.G.gen!Eldorado"
- "Avira": "HEUR/AGEN.1043182"
- "Antiy-AVL": "Trojan/Generic.ASVCS3S.1E5"
- "Microsoft": "Trojan:Win32/AutoitInject.BH!MTB"
- "Arcabit": "Trojan.AutoIt.Agent.XS"
- "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
- "AhnLab-V3": "Win-Trojan/Autoinj02.Exp"
- "Acronis": "suspicious"
- "MAX": "malware (ai score=86)"
- "Ad-Aware": "Trojan.AutoIt.Agent.XS"
- "Rising": "Trojan.Injector/Autoit!1.BB82 (CLASSIC)"
- "Fortinet": "AutoIt/Injector.EGX!tr"
- "Cybereason": "malicious.1ac2f7"
- "MaxSecure": "Trojan.Malware.300983.susgen"
- "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
- "Details":
- "Description": "Checks the system manufacturer, likely for anti-virtualization",
- "Details":
- "Description": "Harvests credentials from local FTP client softwares",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
- "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\"
- "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml"
- "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini"
- "file": "C:\\cftp\\Ftplist.txt"
- "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
- "Description": "Harvests information related to installed mail clients",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
- "Description": "Creates a slightly modified copy of itself",
- "Details":
- "file": "C:\\Users\\user\\AppData\\cmstp\\chgusr.bat"
- "percent_match": 100
- "Description": "Collects information to fingerprint the system",
- "Details":
- "Description": "Anomalous binary characteristics",
- "Details":
- "anomaly": "Actual checksum does not match that reported in PE header"
- * Started Service:
- "VaultSvc"
- * Mutexes:
- "Global\\CLR_PerfMon_WrapMutex",
- "Global\\CLR_CASOFF_MUTEX",
- "Local\\_!MSFTHISTORY!_",
- "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
- "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
- "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
- "Global\\.net clr networking",
- "Global\\F659A567-8ACB-4E4A-92A7-5C2DD1884F72",
- "Global\\__?_c:_programdata_microsoft_rac_statedata_racdatabase.sdf",
- "Global\\__?_c:_programdata_microsoft_rac_statedata_racdatabase.sdf:x",
- "Global\\__?_c:_programdata_microsoft_rac_statedata_racdatabase.sdf:splk:2548",
- "Global\\c90164ff-0d5a-4e39-975b-1f6e5d98cbd7:sqlce_se_lck:1",
- "Global\\c90164ff-0d5a-4e39-975b-1f6e5d98cbd7:sqlce_se_lck:2",
- "Global\\ADAP_WMI_ENTRY",
- "Global\\RefreshRA_Mutex",
- "Global\\RefreshRA_Mutex_Lib",
- "Global\\RefreshRA_Mutex_Flag"
- * Modified Files:
- "C:\\Users\\user\\AppData\\cmstp\\chgusr.bat",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
- "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
- "\\??\\WMIDataDevice",
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
- "C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat",
- "C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf"
- * Deleted Files:
- * Modified Registry Keys:
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\0x433A5C55736572735C7362755C417070446174615C636D737470",
- "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RegAsm_RASAPI32",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\EnableFileTracing",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\EnableConsoleTracing",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\FileTracingMask",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\ConsoleTracingMask",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\MaxFileSize",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\FileDirectory",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\SQMClient\\Reliability\\AdaptiveSqm\\ManifestInfo\\Version"
- * Deleted Registry Keys:
- * DNS Communications:
- "type": "A",
- "request": "checkip.amazonaws.com",
- "answers":
- * Domains:
- "ip": "52.55.255.113",
- "domain": "checkip.amazonaws.com"
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement