ืืขืฆืื ืก, ืึท ืืืืจืืคืขืืฉืขืจ ืคืึทืืจืืงืึทื ื ืคืื ืขืืขืงืืจืืงืึทื ืืึทื ืืึธื ืืืจืื ื ืืืกืจืืื ืงืึธื ืืึทืงืืขื ืืจืืคืข-ืื - ืืืื ืึธื ืืขืฉืืขืืืขืจ ืืืงืืืขื ืึท ืกืึทืกืคึผืืฉืึทืก ืืจืืื ืืื ืึท ืืืืืข ืึทืืึทืืฉืืึทื ื ืืื ืื ืคึผืึธืกื. ืืืืื ืคึผืึธืืขืจืึทื ืฅืขืื, ืึท ืืึทืืืืึทืจืข ืึทื ืึทืืืกืืก ืืืืืข ืืื CERT Group-IB, ืืขืคืืจื ืึท ืืืืืืื ืึทื ืึทืืืกืืก ืคืื ืืขื ืืขืงืข, ืืืกืงืึทืืืขืจื ืื ืึทืืขื ืืืขืกืืึท ืกืคึผืืืืึทืจืข ืืึธืจื ืืื ืืขืจืฆืืืื ืืืึธืก ืฆื ืืขืจืืืึทืจืื ืคืื ืึทืืึท ืืึทืืืืึทืจืข ืืื ืืื ืขืก ืืื ืืขืคืขืจืืขื.
ืืื ืืขื ืคึผืึธืกืื, ืืืจ ืขืคื ืึท ืกืขืจืืข ืคืื โโโโืึทืจืืืงืืขื ืืืขืื ืืื ืฆื ืึทื ืึทืืืื ืึทืืึท ืคึผืึทืืขื ืืฉืึทืื ืืขืคืขืจืืขื ืืขืงืขืก, ืืื ืืืจ ืืืืจืื ืคึฟืึทืจ ืื ืืขืจืกื ืืฉืืงืึทืืืข ืืืืฃ 5 ืืขืฆืขืืืขืจ ืคึฟืึทืจ ืึท ืคืจืื ืื ืืขืจืึทืงืืืื ืืืขืืื ืึทืจ ืืืืฃ ืืขืจ ืืขืืข. "ืืึทืืืืึทืจืข ืึทื ืึทืืืกืืก: ืึทื ืึทืืืกืืก ืคืื ืคืึทืงืืืฉ ืงืึทืกืขืก". ืึทืืข ืื ืคืจืืื ืืขื ืขื ืืื ืืขืจ ืื ืฉื ืืึทืื.
ืคืึทืจืฉืคึผืจืืืืื ื ืืขืงืึทื ืืืึทื
ืืืจ ืืืืกื ืึทื ืื ืืึทืืืืึทืจืข ืจืืืฉื ืื ืืึทืฉืื ืคืื ืื ืงืึธืจืื ืืืจื ืคืืฉืื ื ืืืืืื. ืืขืจ ืืึทืงืืืขืจ ืคืื ืืขื ืืจืืื ืืื ืืืกืืึธืืข BCCed.
ืึทื ืึทืืืกืืก ืคืื ืื ืืขืืขืจื ืืืืืื ืึทื ืืขืจ ืึธืคึผืฉืืงืขืจ ืคืื ืื ืืจืืื ืืื ืืขืืืขื ืกืคึผืึธืึธืคืขื. ืืื ืคืึทืงื, ืืขืจ ืืจืืื ืืื ืงืก ืืื vps56[.]oneworldhosting[.]com.
ืื E- ืืจืืื ืึทืืึทืืฉืืึทื ื ืึผืืื ืึท WinRar ืึทืจืงืืืื qoute_jpeg56a.r15 ืืื ืึท ืืืืืข ืขืงืกืขืงืืืึทืืืข ืืขืงืข QOUTE_JPEG56A.exe ืืื ืขืืืืื ืืง.
ืืึทืืืืึทืจืข ืืงืึธืืกืืกืืึทื
ืืืฆื ืืึธืืืจ ืืขื ืืื ืื ืืงืึธืืกืืกืืึทื ืคืื ืื ืืึทืืืืึทืจืข ืืื ืืขืจ ืืขืจื ืขื ืงืืงื ืืื. ืื ืืืึทืืจืึทืืข ืืื ืื ืืืืืื ืืืึทื ืกืืจืืงืืืจ ืืื ืื ืืื ืกืืจืืงืฆืืขืก ืคืื ืื ืืขืจืึทืงืฉืึทื ืคืื ืื ืงืึทืืคึผืึธืื ืึทื ืฅ.
ืืืฆื ืืึธืื ืก ืงืืง ืืื ืืขืืขืจ ืคืื ืื ืืึทืืืืึทืจืข ืงืึทืืคึผืึธืื ืึทื ืฅ ืืื ืืขืจ ืืขืืึทื.
ืืึธืืืขืจ
ืึธืจืืืื ืขื ืืขืงืข QOUTE_JPEG56A.exe ืืื ืึท ืฆืื ืืืคืืขืฉืืขืื AutoIt v3 ืฉืจืืคื.
ืฆื ืคืึทืจืฉืืึทืจืงื ืื ืึธืจืืืื ืขื ืฉืจืืคื, ืึท ืึธืืคืืกืงืึทืืึธืจ ืืื ืขื ืืขื PELock AutoIT-Obfuscator ืงืขืจืึทืงืืขืจืืกืืืงืก.
ืืขืึธืืคืืกืงืึทืืืึธื ืืื ืืืจืืืขืงืึธืื ืืื ืืจืืึท ืกืืึทืืขืก:
- ืจืืืืืืื ื ืึทืืคืึทืกืงืืืฉืึทื ืคึฟืึทืจ-ืืืื
ืืขืจ ืขืจืฉืืขืจ ืฉืจืื ืืื ืฆื ืืืงืขืจื ืื ืงืึธื ืืจืึธื ืืืืคื ืคืื ืื ืฉืจืืคื. ืงืึธื ืืจืึธื ืคืืึธื ืคืืึทืื ืื ื ืืื ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืคึผืจืึธืกื ืืืขืื ืฆื ืืึทืฉืืฆื ืืืื ืขืจื ืงืึธื ืคืื ืึทืคึผืืึทืงืืืฉืึทื ืคืื ืึทื ืึทืืืกืืก. ืงืึทื ืคืืืืื ื ืืจืึทื ืกืคืขืจืืืืฉืึทื ื ืืจืึทืืึทืืืงืื ืคืึทืจืืจืขืกืขืจื ืื ืงืึทืืคึผืืขืงืกืืื ืคืื ืืงืกืืจืึทืงืืื ื ืืื ืจืขืงืึทืื ืืืืื ื ืึทืืืขืจืืืึทืื ืืื ืืึทืื ืกืืจืึทืงืืฉืขืจื.
- ืจืืืขืจื ืึธืคึผืืื
ืฆืืืื ืคืึทื ืืงืฉืึทื ื ืืขื ืขื ืืขื ืืฆื ืฆื ืขื ืงืจืืคึผื ืกืืจืื ืืก:
- gdorizabegkvfca - ืคึผืขืจืคืึธืจืื Base64-ืืื ืืืงืึธืืืื ื
- xgacyukcyzxz - ืคึผืฉืื ืืืื-ืืืืข XOR ืคืื ืืขืจ ืขืจืฉืืขืจ ืฉืืจืืงื ืืื ืื ืืขื ื ืคืื ืื ืจืืข
- gdorizabegkvfca - ืคึผืขืจืคืึธืจืื Base64-ืืื ืืืงืึธืืืื ื
- ืจืืืืืืื ื ืึทืืคืึทืกืงืืืฉืึทื ืืืื ืขืจืืืึธืกืืจืื ื ะธ ืืืกืคืืจื
ืื ืืืืคึผื ืืึทืกืข ืืื ืกืืึธืจื ืืื ืึท ืฆืขืืืืื ืคืึธืจืขื ืืื ืื ืืืขืืืืืึทืืขืจ ืคืึทื ืฅ ืืืื ืกืขืงืฉืึทื ื ืคืื ืืขืจ ืืขืงืข.
ืื ืกืืจ ืคืื ืงืืืืึทื ืืื ืืื ืืืื: TIEQHCXWFG, ืืืข, SPDGUHIMPV, KQJMWQQAQTKTFXTUOSW, AOCHKRWWSKWO, JSHMSJPS, NHHWXJBMTTSPXVN, BFUTIFWWXVE, HWJHO, AVZOUMVFRDWFLWU.
ืื WinAPI ืคืื ืงืฆืืข ืืื ืืขื ืืฆื ืฆื ืืขืงืจืืคึผื ืื ืืงืกืืจืึทืงืืื ืืึทืื ืงืจืืคึผืืืขืงืจืืคึผื, ืืื ืืขืจ ืกืขืกืืข ืฉืืืกื ืืืฉืขื ืขืจืืืืึทื ืืืืืจื ืืืืฃ ืื ืืืขืจื ืืื ืืขื ืืฆื ืืื ืืขืจ ืฉืืืกื fZgFiZlJDxvuWatFRgRXZqmNCIyQgMYc.
ืื ืืขืงืจืืคึผืืขื ืขืงืกืขืงืืืึทืืืข ืืขืงืข ืืื ืืขืฉืืงื ืฆื ืื ืคืื ืงืฆืืข ืึทืจืืึทื ืฉืจืืึทื RunPE, ืืืึธืก ืคืืจื ืืืืก ProcessInject ะฒ RegAsm.exe ื ืืฆื ืืขืืืื-ืืื ืฉืขืืงืึธืืข (ืืืื ืืืงืื ื ืืืฅ RunPE ShellCode). ืืืืืึธืจืฉืืคึผ ืืขืืขืจื ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืคืื ืื ืฉืคึผืึทื ืืฉ ืคืึธืจืื ืื ืืขืืขืงืืึทืืืขืก[.]ื ืขืฅ ืืื ืืขืจ ืื ืฆืื ืขืืขื ืืฉ Wardow.
ืขืก ืืื ืืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืืื ืืืื ืขืจ ืคืื ืื ืคึฟืขืืขื ืคืื ืืขื ืคืึธืจืื, ืึท ืึธืืคืืกืงืึทืืึธืจ ืคึฟืึทืจ ืืฒื ืืื ืืื ืขื ืืขื ืคึผืจืึธืคึผืขืจืืืขืก ืืืืขื ืึทืคืืื ืืขืฉืึทืก ืืืกืืขืจ ืึทื ืึทืืืกืืก.
ืืื ืฉืขืืงืึธืืข ืืึทื ืฅ ืคึผืฉืื ืืื ืึทืืจืึทืงืฅ ืืคืืขืจืงืืึทืืงืืึทื ืืืืื ืืึทืจืึธืื ืคืื ืื ืืขืงืขืจ ืืจืืคึผืข AnunakCarbanak. ืึทืคึผื ืจืืคื ืืึทืฉืื ื ืคึฟืื ืงืฆืืข.
ืืืจ ืืขื ืขื ืืืื ืึทืืืขืจ ืคืื ื ืืฆื ืงืึทืกืขืก ืคืจืื ืฆืืืืืฉ ืฉืขืืงืึธืืข ืคืึทืจืฉืืืขื ืข ืืืขืจืกืืขืก.
ืืื ืึทืืืฉืึทื ืฆื ืื ืืืกืงืจืืืื ืคืึทื ืืงืฉืึทื ืึทืืืื, ืืืจ ืืืื ืืืืขื ืึทืคืืื ืื ืึทืงืืืื ืคืึทื ืืงืฉืึทื ื:
- ืืืึทืงืื ื ืืึทื ืืึทื ืคึผืจืึธืฆืขืก ืืขืจืืึทื ืืืฉืึทื ืืื ืึทืจืืขื ืคืึทืจืืืึทืืืขืจ
- ืจืืกืืึทืจืืื ื ืึท ืงืื ื ืคึผืจืึธืฆืขืก ืืืขื ืขืก ืืขืจืืึทื ืืืฅ
- ืืืืคึผืึทืก UAC
- ืฉืคึผืึธืจื ืื ืคึผืืืืึธืื ืฆื ืึท ืืขืงืข
- ืืขืืึทื ืกืืจืืืฉืึทื ืคืื ืืึธืืึทื ืคึฟืขื ืฆืืขืจ
- ืืืืจืื ืคึฟืึทืจ ืื ืืืื ืืืืคึฟืขืจ ืฉืืขืืข ืฆื ืืืืฉื
- ืึทื ืืืืื ืืื ืึทื ืืืกืึทื ืืืึธืงืก
- ืืื-ืฆืขืฉืืขืจืื ื
- ืคึผืึทืืคึผืื ื ืคึผืืืืึธืื ืคืื ืื ื ืขืฅ
ืืืจ ืืืืกื ืึทื ืึทืืึท ืคืึทื ืืงืฉืึทื ืึทืืืื ืืื ืืืคึผืืฉ ืคึฟืึทืจ ืื ืคึผืจืึธืืขืงืืึธืจ CypherIT, ืืืึธืก, ืืฉืืขืืช, ืืื ืื ืืึธืึธืืืึธืึทืืขืจ ืืื ืงืฉืื.
ืืืืคึผื ืืึธืืืืข ืคืื โโืืืืืืืืืจื
ืืืืึทืืขืจ, ืืืจ ืืืขืื ืืขืงืืฆืขืจ ืืึทืฉืจืืึทืื ืื ืืืืคึผื ืืึธืืืืข ืคืื โโืื ืืึทืืืืึทืจืข, ืืื ืืึทืืจืึทืืื ืขืก ืืื ืืขืจ ืืขืืึทื ืืื ืื ืจืืข ืึทืจืืืงื. ืืื ืืขื ืคืึทื, ืขืก ืืื ืึท ืึทืคึผืืึทืงืืืฉืึทื ืืืืฃ . ื ืขืฅ.
ืืขืฉืึทืก ืื ืึทื ืึทืืืกืืก, ืืืจ ืืืกืงืึทืืืขืจื ืึทื ืึท ืึธืืคืืกืงืึทืืึธืจ ืืื ืืขื ืืฆื ืงืึธื ืคืืกืขืจืขืงืก.
IELibrary.dll
ืื ืืืืืืึธืืขืง ืืื ืกืืึธืจื ืืื ืึท ืืืืคึผื ืืึธืืืืข ืืืื ืืื ืืื ืึท ืืึทืืืืกื ืคึผืืืืื ืคึฟืึทืจ ืึทืืขื ื ืืขืกืืึท, ืืืึธืก ืืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืคึฟืึทืจ ืขืงืกืืจืึทืงื ืคืึทืจืฉืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืคึฟืื Internet Explorer ืืื ืขืืืฉ ืืจืึทืืืขืจื.
ืึทืืขื ื ืืขืกืืึท ืืื ืึท ืืึทืืืฉืึทืืขืจ ืกืคึผืืืื ื ืืืืืืืืืจื ืคืื ืื ืืขืจืืขืืืืื ื ืืฆื ืึท ืืึทืืืืึทืจืข-ืืื-ืึท-ืืื ืกื ืืึธืืขื ืืื ืืขืจ ืื ืืืื ืคืื ืึท ืืึทืืืฉืืืึทืืึทื ืงืืืืึธืืืขืจ ืคึผืจืึธืืืงื. ืึทืืขื ื ืืขืกืืึท ืืื ืืืืืืช ืฆื ืขืงืกืืจืึทืงื ืืื ืืจืึทื ืกืืืืื ื ืืึทื ืืฆืขืจ ืงืจืึทืืขื ืืฉืึทืื ืคืื ืืจืึทืืืขืจื, E- ืืจืืื ืงืืืืึทื ืฅ ืืื ืคืืคึผ ืงืืืืึทื ืฅ ืฆื ืื ืกืขืจืืืขืจ ืฆื ืึทืืึทืงืขืจื, ืจืขืงืึธืจืืื ื ืงืืืคึผืืึธืจื ืืึทืื ืืื ืืึทืคึผื ืื ืคืึทืจืฉืืขืื ืคืื ืื ืืืื. ืืื ืืขืจ ืฆืืื ืคืื ืึทื ืึทืืืกืืก, ืืขืจ ืืึทืึทืืืขืจ ืืืขืืืืืื ืคืื ืื ืืขืืืขืืึธืคึผืขืจืก ืืื ืืขืืืขื ืึทื ืึทืืืืืืึทืืึทื.
ืืขืจ ืึทืจืืึทื ืืึทื ื ืคืื ื ืืื ืื ืคึฟืื ืงืฆืืข GetSavedPasswords ืงืืึทืก InternetExplorer.
ืืื ืึทืืืขืืืื, ืงืึธื ืืืจืืคืืจืื ื ืืื ืืื ืขืึทืจ ืืื ืึผืืื ืงืืื ืฉืืฅ ืงืขืื ืึทื ืึทืืืกืืก. ืืืืื ืื ืึทื ืจืืืืืื ืคึฟืื ืงืฆืืข ืคืืจืืื ื ืืคืืขืจืงืืึทืืงืืึทื GetSavedCookies. ืืฉืืขืืช, ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืคืื ืื ืคึผืืืืื ืืื ืืขืืืขื ืืขืืืื ื ืฆื ืืืื ืืงืกืคึผืึทื ืืื, ืึธืืขืจ ืืึธืก ืืื ืงืืื ืืึธื ืืขืืื.
ืึทืืึทืืฉืื ื ืื ืืึธืึธืืืึธืึทืืขืจ ืฆื ืื ืกืืกืืขื
ืืึธืืืจ ืืขืจื ืขื ืืื ืื ืืึธืึธืืืึธืึทืืขืจ ืืื ืึทืืึทืืฉื ืฆื ืื ืกืืกืืขื. ืืขืจ ืกืคึผืขืกืึทืืึทื ืืื ืืขืจ ืืขืจื ืขื ืืื ื ืืฉื ืืืจืืคืืจื ืึทื ืืงืขืจืื ื, ืึธืืขืจ ืืื ืขื ืืขื ืืขืฉืขืขื ืืฉื ืขืก ืึทืงืขืจื ืืืื ืื ืคืืืืขื ืืข ืกืืขืืข:
- ืืื ืืขืงืข C: UserPublic ืฉืจืืคื ืืื ืืืฉืืคื ืืืืกืืึทื ืืึทืกืืง
ืกืงืจืืคึผื ืืืึทืฉืคึผืื:
- ืืขืจ ืืื ืืึทืื ืคืื ืื ืืึธืึธืืืึธืึทืืขืจ ืืขืงืข ืืื ืคึผืึทืืื ืืื ืึท ื ืึทื ืืึทืจืึทืงืืขืจ ืืื ืืขืจืืืขืืืขื ืืื ืืขืจ ืืขืงืข %temp%<ืื ืื ืืขืงืข ื ืึธืืขื>ืืขืงืข ื ืึธืืขื>
- ืึท ืึทืืืึธืจืื ืฉืืืกื ืืื ืืืฉืืคื ืืื ืื ืจืขืืืกืืจื ืคึฟืึทืจ ืื ืฉืจืืคื ืืขืงืข HKCUSoftwareMicrosoftWindowsCurrentVersionRun<ืกืงืจืืคึผื ื ืึธืืขื>
ืึทืืื, ืืืืืจื ืืืืฃ ืื ืจืขืืืืืึทืื ืคืื ืืขืจ ืขืจืฉืืขืจ ืืืื ืคืื ืืขืจ ืึทื ืึทืืืกืืก, ืืืจ ืืขื ืขื ืืืืืืช ืฆื ืคืึทืจืืืืื ืื ื ืขืืขื ืคืื ืื ืคืึทืืืืืขืก ืคืื ืึทืืข ืงืึทืืคึผืึธืื ืึทื ืฅ ืคืื ืื ืืึทืืืืึทืจืข ืืื ืืขืจ ืืขืจื ืขื, ืึทื ืึทืืืื ืื ืื ืคืขืงืฆืืข ืืืกืืขืจ ืืื ืืืื ืืึทืงืืืขื ืึทืืืืฉืขืงืฅ ืคึฟืึทืจ ืฉืจืืืื ืกืืื ืึทืืฉืขืจื. ืืืจ ืืืขืื ืคืึธืจืืขืฆื ืืื ืืืขืจ ืึทื ืึทืืืกืืก ืคืื ืืขื ืืืืคืขืฅ ืืื ืืขืจ ืืืืึทืืขืจ ืึทืจืืืงื, ืืื ืืืจ ืืืขืื ืงืืงื ืืื ืื ืืืืคึผื ืืึธืืืืข ืืื ืืขืจ ืืขืืึทื ืึทืืขื ื ืืขืกืืึท. ืื ืืืืกื ื ืืฉื ืคืึทืจืคืืจื!
ืืืจื ืืขื ืืืขื, ืืืืฃ 5 ืืขืฆืขืืืขืจ ืืืจ ืืึทืื ืึทืืข ืืืืขื ืขืจ ืฆื ืึท ืคืจืื ืื ืืขืจืึทืงืืืื ืืืขืืื ืึทืจ ืืืืฃ ืืขืจ ืืขืืข "ืึทื ืึทืืื ืคืื ืืึทืืืืึทืจืข: ืึทื ืึทืืืกืืก ืคืื ืคืึทืงืืืฉ ืงืึทืกืขืก", ืืื ืืขืจ ืืืืจ ืคืื ืืขื ืึทืจืืืงื, ืึท CERT-GIB ืืืืืข, ืืืขื ืืืืึทืื ืึธื ืืืื ืืขืจ ืขืจืฉืืขืจ ืืื ืข ืคืื ืืึทืืืืึทืจืข ืึทื ืึทืืืกืืก - ืืึทืื-ืึธืืึทืืึทืืืง ืึทื ืคึผืึทืงืื ื ืคืื ืกืึทืืคึผืึทืื ื ืืฆื ืื ืืืืฉืคึผืื ืคืื ืืจืื ืคืึทืงืืืฉ ืืื ื ืงืึทืกืขืก ืคืื ืคืืจ, ืืื ืืืจ ืงืขื ืขื ื ืขืืขื ืึธื ืืืื ืืื ืื ืึทื ืึทืืืกืืก. ืืขืจ ืืืขืืื ืึทืจ ืืื ืคึผืึทืกืืง ืคึฟืึทืจ ืกืคึผืขืฉืึทืืึทืกืฅ ืืืึธืก ืืึธืื ืฉืืื ืืขืจืคืึทืจืื ื ืืื ืึทื ืึทืืืืืื ื ืืืืืข ืืขืงืขืก. ืจืขืืืกืืจืึทืฆืืข ืืื ืฉืืจืขื ื ืคึฟืื ืคึฟืืจืืข E- ืืจืืื: . ืืื ืืืืจื ืืืืฃ ืืืจ!
ืืึทืจืึท
rule AgentTesla_clean{
meta:
author = "Group-IB"
file = "78566E3FC49C291CB117C3D955FA34B9A9F3EEFEFAE3DE3D0212432EB18D2EAD"
scoring = 5
family = "AgentTesla"
strings:
$string_format_AT = {74 00 79 00 70 00 65 00 3D 00 7B 00 30 00 7D 00 0D 00 0A 00 68 00 77 00 69 00 64 00 3D 00 7B 00 31 00 7D 00 0D 00 0A 00 74 00 69 00 6D 00 65 00 3D 00 7B 00 32 00 7D 00 0D 00 0A 00 70 00 63 00 6E 00 61 00 6D 00 65 00 3D 00 7B 00 33 00 7D 00 0D 00 0A 00 6C 00 6F 00 67 00 64 00 61 00 74 00 61 00 3D 00 7B 00 34 00 7D 00 0D 00 0A 00 73 00 63 00 72 00 65 00 65 00 6E 00 3D 00 7B 00 35 00 7D 00 0D 00 0A 00 69 00 70 00 61 00 64 00 64 00 3D 00 7B 00 36 00 7D 00 0D 00 0A 00 77 00 65 00 62 00 63 00 61 00 6D 00 5F 00 6C 00 69 00 6E 00 6B 00 3D 00 7B 00 37 00 7D 00 0D 00 0A 00 73 00 63 00 72 00 65 00 65 00 6E 00 5F 00 6C 00 69 00 6E 00 6B 00 3D 00 7B 00 38 00 7D 00 0D 00 0A 00 5B 00 70 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 73 00 5D 00}
$web_panel_format_string = {63 00 6C 00 69 00 65 00 6E 00 74 00 5B 00 5D 00 3D 00 7B 00 30 00 7D 00 0D 00 0A 00 6C 00 69 00 6E 00 6B 00 5B 00 5D 00 3D 00 7B 00 31 00 7D 00 0D 00 0A 00 75 00 73 00 65 00 72 00 6E 00 61 00 6D 00 65 00 5B 00 5D 00 3D 00 7B 00 32 00 7D 00 0D 00 0A 00 70 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 5B 00 5D 00 3D 00 7B 00 33 00 7D 00 00 15 55 00 52 00 4C 00 3A 00 20 00 20 00 20 00 20 00 20 00 20 00 00 15 55 00 73 00 65 00 72 00 6E 00 61 00 6D 00 65 00 3A 00 20 00 00 15 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 3A 00}
condition:
all of them
}
rule AgentTesla_obfuscated {
meta:
author = "Group-IB"
file = "41DC0D5459F25E2FDCF8797948A7B315D3CB075398D808D1772CACCC726AF6E9"
scoring = 5
family = "AgentTesla"
strings:
$first_names = {61 66 6B 00 61 66 6D 00 61 66 6F 00 61 66 76 00 61 66 79 00 61 66 78 00 61 66 77 00 61 67 6A 00 61 67 6B 00 61 67 6C 00 61 67 70 00 61 67 72 00 61 67 73 00 61 67 75 00}
$second_names = "IELibrary.resources"
condition:
all of them
}
rule AgentTesla_module_for_IE{
meta:
author = "Group-IB"
file = "D55800A825792F55999ABDAD199DFA54F3184417215A298910F2C12CD9CC31EE"
scoring = 5
family = "AgentTesla_module_for_IE"
strings:
$s0 = "ByteArrayToStructure"
$s1 = "CryptAcquireContext"
$s2 = "CryptCreateHash"
$s3 = "CryptDestroyHash"
$s4 = "CryptGetHashParam"
$s5 = "CryptHashData"
$s6 = "CryptReleaseContext"
$s7 = "DecryptIePassword"
$s8 = "DoesURLMatchWithHash"
$s9 = "GetSavedCookies"
$s10 = "GetSavedPasswords"
$s11 = "GetURLHashString"
condition:
all of them
}
rule RunPE_shellcode {
meta:
author = "Group-IB"
file = "37A1961361073BEA6C6EACE6A8601F646C5B6ECD9D625E049AD02075BA996918"
scoring = 5
family = "RunPE_shellcode"
strings:
$malcode = {
C7 [2-5] EE 38 83 0C // mov dword ptr [ebp-0A0h], 0C8338EEh
C7 [2-5] 57 64 E1 01 // mov dword ptr [ebp-9Ch], 1E16457h
C7 [2-5] 18 E4 CA 08 // mov dword ptr [ebp-98h], 8CAE418h
C7 [2-5] E3 CA D8 03 // mov dword ptr [ebp-94h], 3D8CAE3h
C7 [2-5] 99 B0 48 06 // mov dword ptr [ebp-90h], 648B099h
C7 [2-5] 93 BA 94 03 // mov dword ptr [ebp-8Ch], 394BA93h
C7 [2-5] E4 C7 B9 04 // mov dword ptr [ebp-88h], 4B9C7E4h
C7 [2-5] E4 87 B8 04 // mov dword ptr [ebp-84h], 4B887E4h
C7 [2-5] A9 2D D7 01 // mov dword ptr [ebp-80h], 1D72DA9h
C7 [2-5] 05 D1 3D 0B // mov dword ptr [ebp-7Ch], 0B3DD105h
C7 [2-5] 44 27 23 0F // mov dword ptr [ebp-78h], 0F232744h
C7 [2-5] E8 6F 18 0D // mov dword ptr [ebp-74h], 0D186FE8h
}
condition:
$malcode
}
rule AgentTesla_AutoIT_module{
meta:
author = "Group-IB"
file = "49F94293F2EBD8CEFF180EDDD58FA50B30DC0F08C05B5E3BD36FD52668D196AF"
scoring = 5
family = "AgentTesla"
strings:
$packedexeau = {55 ED F5 9F 92 03 04 44 7E 16 6D 1F 8C D7 38 E6 29 E4 C8 CF DA 2C C4 E1 F3 65 48 25 B8 93 9D 66 A4 AD 3C 39 50 00 B9 60 66 19 8D FC 20 0A A0 56 52 8B 9F 15 D7 62 30 0D 5C C3 24 FE F8 FC 39 08 DF 87 2A B2 1C E9 F7 06 A8 53 B2 69 C3 3C D4 5E D4 74 91 6E 9D 9A A0 96 FD DB 1F 5E 09 D7 0F 25 FB 46 4E 74 15 BB AB DB 17 EE E7 64 33 D6 79 02 E4 85 79 14 6B 59 F9 43 3C 81 68 A8 B5 32 BC E6}
condition:
all of them
}
ืืึทืฉืขืก
| ื ืึธืืขื | qoute_jpeg56a.r15 |
| ืืืงืกื ืืืงืก | 53BE8F9B978062D4411F71010F49209E |
| ืฉืึทืงืกื ืืืงืก | A8C2765B3D655BA23886D663D22BDD8EF6E8E894 |
| ืฉืึทืงืกื ืืืงืก | 2641DAFB452562A0A92631C2849B8B9CE880F0F8F
890E643316E9276156EDC8A |
| ืืืคึผ | Archive WinRAR |
| ืืจืืืก | 823014 |
| ื ืึธืืขื | QOUTE_JPEG56A.exe |
| ืืืงืกื ืืืงืก | 329F6769CF21B660D5C3F5048CE30F17 |
| ืฉืึทืงืกื ืืืงืก | 8010CC2AF398F9F951555F7D481CE13DF60BBECF |
| ืฉืึทืงืกื ืืืงืก | 49F94293F2EBD8CEFF180EDDD58FA50B30DC0F08
C05B5E3BD36FD52668D196AF |
| ืืืคึผ | PE (ืงืึธืืคึผืืืขื ืึทืืืึธืื ืกืงืจืืคึผื) |
| ืืจืืืก | 1327616 |
| ืึธืจืืืื ืขื ื ืึธืืขื | ืืืืึทืงืึทื ื |
| DateStamp | 15.07.2019 |
| ืืื ืงืขืจ | Microsoft Linker (12.0) [EXE32] |
| ืืืงืกื ืืืงืก | C2743AEDDADACC012EF4A632598C00C0 |
| ืฉืึทืงืกื ืืืงืก | 79B445DE923C92BF378B19D12A309C0E9C5851BF |
| ืฉืึทืงืกื ืืืงืก | 37A1961361073BEA6C6EACE6A8601F646C5B6ECD
9D625E049AD02075BA996918 |
| ืืืคึผ | ืฉืขืืงืึธืืข |
| ืืจืืืก | 1474 |
ืืงืืจ: www.habr.com