agenttesla

Sharing

Copy URL

Twitter E-mail

General

Target

114X.zip
Size

9.4MB
Sample

210220-dt586ts4wa
MD5

df9d7ef0310b8816d2b35ad4eb08ed4a
SHA1

b3ab69ccd166af8ea9f47acc10e2f261ff5643ec
SHA256

d3f4d352d63d7565acc222c50c0fccf56a7d90ad1623ae32e3a7f0e3b9ea5dfc
SHA512

ea919dc688732186d200b6c2f40160ba29d83f880de94cbce994d5115ed6993eae3d322ed78b9158acac03488f6f257bfa5e2b8414ab13d59a9bdda895d1ff7d

Malware Config

Extracted

Family

lokibot

http://51.195.53.221/p.php/7gEWZ4upg1lkl

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://51.195.53.221/p.php/9jOsfsOpZTcJM

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://casadodestino.com/ds/1802.gif

Extracted

Family

dridex

Botnet

10444

209.20.87.138:443

198.1.115.153:8172

151.236.29.248:6516

rc4.plain

Extracted

Family

remcos

capriteam.ddns.net:1010

Targets

- Target
  
  08af4703386cb3cd9728fe81b7c1b5e4621cc476ebc41dc72204d4b98ae2df22.exe
- Size
  
  76KB
- MD5
  
  a851dcd69acace9fb77c30113773df84
- SHA1
  
  88a6f2f7bc54de1579ba00f05801f7195624bbcd
- SHA256
  
  08af4703386cb3cd9728fe81b7c1b5e4621cc476ebc41dc72204d4b98ae2df22
- SHA512
  
  92a46fc45ec40ae007854a4be5ea9840a02da24acfca845f768f2e95605c607fabc706ee75b10b47b02c150b18e6c717101f6b3fc4877c2e585a8c44ca94d186
Score

1^/10
behavioral1 behavioral2
- Target
  
  1a86f37c4830102f274d8d26e167412e5f0d8e82d66008d63066e1c48e285e38.exe
- Size
  
  926KB
- MD5
  
  5ed5b94897d82472b563b234a98d6fe9
- SHA1
  
  6b0650fd532532d5206768d86c3529e550641adf
- SHA256
  
  1a86f37c4830102f274d8d26e167412e5f0d8e82d66008d63066e1c48e285e38
- SHA512
  
  60b22193ef40e464cedfc509c7641e89bd9fc176941ff3bea3224072eeda5f3b8a03c9290c941ee0a9c94a5de498279aa374cd4fbd442386d725914b0e47f856
Score

1^/10
behavioral3 behavioral4
- Target
  
  1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
- Size
  
  506KB
- MD5
  
  87f2e974ce1409d31ff4357ca83cdc51
- SHA1
  
  896d62c4d3c728d11c2122ede992a3359840b85e
- SHA256
  
  1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287
- SHA512
  
  7a91f4f38bac4ebe588d90d365d8afc6f295c1871e27d47f2cf1525871e5cc57fc186b397212cce59044597b8d44a5ab4b643c07bc281e5597f03063e6a09196
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  
  1dda56e38d9187c2f440a838d59474055045bad5791fc75794b1472350e2a328.exe
- Size
  
  911KB
- MD5
  
  be38d6a99042167ac46211ed057a7c50
- SHA1
  
  859902d618afa0a01bafe44d309b5b1420c08286
- SHA256
  
  1dda56e38d9187c2f440a838d59474055045bad5791fc75794b1472350e2a328
- SHA512
  
  a39ec42109e985222c9e5259b547e6f0ab5cf265e6826c55a6bfc2bd201b39b2a5f0ca140983763f1096208a4a2ea2432689fa414d7d9665d1c6b7dad345b742
Score

8^/10
- Tries to connect to .bazar domain
  Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral7 behavioral8
- Target
  
  1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
- Size
  
  599KB
- MD5
  
  00d5e736e281b30f3ac9c5783340a561
- SHA1
  
  b7266f3f7443368d208ce4b1902cb9e4feaf6f8b
- SHA256
  
  1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94
- SHA512
  
  05c17c2a42a715ec3576275b2daf6090c0710f62758e1fbf1e83792e8408faa28ea1c8d7158a02aa94df2803e9a27b02b07876a7e53d50ed4f092d00ea0b526f
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral9 behavioral10
- Target
  
  2b08e7b15acdf76390aa499573b76edbdc69617be61a2fbc0536eb24eada0c79.xlsx
- Size
  
  165KB
- MD5
  
  8ba19b8ef6dbf8caa528664f1fff8cfd
- SHA1
  
  59cd545ac4a3681e4c1f640a85827d1a57738112
- SHA256
  
  2b08e7b15acdf76390aa499573b76edbdc69617be61a2fbc0536eb24eada0c79
- SHA512
  
  9ff0258f8b24aaa275a9a5c6db2c5306752a6105e7256e263268daf44d6931a47f9bb108be8e1f6bddb84d74cd83064729b86f0d9eb371e4b2061d71ce88d492
Score

1^/10
behavioral11 behavioral12
- Target
  
  3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e.dll
- Size
  
  180KB
- MD5
  
  7831a9eebbb485ab4850460e33185cb3
- SHA1
  
  433471495f168d8361971f95fff1a1e78dc1ea81
- SHA256
  
  3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e
- SHA512
  
  a5c9d45569c09d9022ee8545e761ab1803ae994255f466e57d588fe51cf1517586f227f5b568361b3cc42bcc2f1dc04d8bae7ea2d7836ea2d00f62500add6f7c
Score

1^/10
behavioral13 behavioral14
- Target
  
  4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
- Size
  
  2.2MB
- MD5
  
  8053506734f293e5b9a7d5a74a63efb6
- SHA1
  
  afbb07b83da8f55d49a251cb55247ac112ef12e0
- SHA256
  
  4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91
- SHA512
  
  f4f0e82203d11d641e251881db91392c3f50119637c5a9a62f14d3e475b17936c42ca3de24e15c8b18640c97a9073fa8cafea769e285be5fca93316b1c55dde2
Score

10^/10

redline agilenet infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Suspicious use of SetThreadContext
behavioral15 behavioral16
- Target
  
  4b7659b234e140d7f27e16de31ff5e78d9047d190032aaf4dbfe7684b08f6d63.exe
- Size
  
  12KB
- MD5
  
  fd4c3caaa1ade82c542c3c2d89ce8ad3
- SHA1
  
  0dc8eb2de32a9258fa22f68932a66a73cb3e4308
- SHA256
  
  4b7659b234e140d7f27e16de31ff5e78d9047d190032aaf4dbfe7684b08f6d63
- SHA512
  
  7c173f069fea9ad237bfa1f44174c4f80a937eb02b2454269bfa55adbe669cf6bef997198661156318d201d8c05be6f78a9616ecb9258d483b49f60fafbacd7a
Score

1^/10
behavioral17 behavioral18
- Target
  
  4bb4e4e1b44c388a8244e7d13a7d68797c5b6cc1cc9d93e2bc16a6b47b929c91.xls
- Size
  
  88KB
- MD5
  
  1af54d57411fbcc869e5e1529fb44ea7
- SHA1
  
  dbc1869ef77fd68867db0b8fce0fbff53b19354e
- SHA256
  
  4bb4e4e1b44c388a8244e7d13a7d68797c5b6cc1cc9d93e2bc16a6b47b929c91
- SHA512
  
  c46f2ee5b50fc01d5a18d71535132ca6fe12d5e293aa6b3049931c6e16472f10ba2c92cb2c18357cf8c0e5ddcef7d730e46e3c93fa57bc7142e834ea5e123073
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral19 behavioral20
- Target
  
  4c4420fc8167dc9d7a4bae0c3fc92ffd5bc3217e0c0eab1ba931cc1930233296.exe
- Size
  
  489KB
- MD5
  
  ad7d7f4c9bb6f118eaeb64d69cce1393
- SHA1
  
  70babe9dcdf1850c2d1fe7300866cbe8513625d8
- SHA256
  
  4c4420fc8167dc9d7a4bae0c3fc92ffd5bc3217e0c0eab1ba931cc1930233296
- SHA512
  
  48be791eea9049517769978de24854acf17a5de511d23b9b7871ecfbb5d2b36119fe852a13dee1b3085ff5d0532d80624dd81dc47c354b7b19e99291dcc776f8
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Beds Protector Packer
  Detects Beds Protector packer used to load .NET malware.
- Suspicious use of SetThreadContext
behavioral21 behavioral22
- Target
  
  4e8b50459a8033a3e81008fe1e01df1997193d59f1012125325ee127281f387d.dll
- Size
  
  785KB
- MD5
  
  5cb98dc4e31e1e09b9ecf06a5fbc75f2
- SHA1
  
  4f8d8d02dbfbd65b7c24d46c0439ee245941470a
- SHA256
  
  4e8b50459a8033a3e81008fe1e01df1997193d59f1012125325ee127281f387d
- SHA512
  
  3a97dbed4172bdc59f505dc79fb67cf394eb2701c7ea2dc8778ebb97426f4bfb89031fc0667b3fe964f7b18e4561ce6e7aba840a412f654c24257bf7f9e30c6a
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral23 behavioral24
- Target
  
  4ec8577958337ec055aff17e6e41d1bcc3948972d7d60ccaaa4fca91794b85ff.xlsx
- Size
  
  2.5MB
- MD5
  
  db39ec6b233809325a3347e2f47a2021
- SHA1
  
  554e79718c1f49fc1bd70f641ebcbe9805381788
- SHA256
  
  4ec8577958337ec055aff17e6e41d1bcc3948972d7d60ccaaa4fca91794b85ff
- SHA512
  
  5874c18ed11a51901a00fa55788464bf99455be83925777babf5c0773bfc3111839be191a2ea11db65c4dc99a5d1732a86ee501bdcf9d1096f9691f375ae8c40
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral25 behavioral26
- Target
  
  6abf4544f60ac6117706727c241b97924e0c474f505838d0eb0491fc62b673cd.exe
- Size
  
  120KB
- MD5
  
  f924cec68be776e41726ee765f469d50
- SHA1
  
  f7125695a1c59970b7557362c67f81d93d871373
- SHA256
  
  6abf4544f60ac6117706727c241b97924e0c474f505838d0eb0491fc62b673cd
- SHA512
  
  db1d26df5d8772c2269cdca51997a70affce5a68dba742c32f6812612b9925dabd01d5e1666e1cc8d20086bef1c82f1df09d4979212a18f214f5b0bfe44e8cda
Score

1^/10
behavioral27 behavioral28
- Target
  
  6f0f5ac2a08c4746186a79f3afe48a614b1ed180ce830058805354bfa8cb1e8e.exe
- Size
  
  412KB
- MD5
  
  3932f812b26f3bff1d20070c58468f2e
- SHA1
  
  cbbd717f6fc0efebb051ca6329b90d8473dc5366
- SHA256
  
  6f0f5ac2a08c4746186a79f3afe48a614b1ed180ce830058805354bfa8cb1e8e
- SHA512
  
  9b3b414a5552635e111d97b4f3bb458ca778eeaed38b30d9236ff9cd095e9f2e5a28666756e5382adfcaf04b0692b00cec6ea42d984609f1d1f3b2e75377f104
Score

10^/10

remcos persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral29 behavioral30
- Target
  
  6f7620033e5a6b1283b801c2c97d2bd5dcacb72a2b1ba709b6a763394c6a6aca.dll
- Size
  
  785KB
- MD5
  
  24499a2accccfce4f2fa27621c832167
- SHA1
  
  85e91e7ff19d5438e84422b367acbc32a6ffad4b
- SHA256
  
  6f7620033e5a6b1283b801c2c97d2bd5dcacb72a2b1ba709b6a763394c6a6aca
- SHA512
  
  9d0564d490c9b74d39c11620719315ed51589bfe48e366a8ea9c63d5eb6dc3f5320649f6a636bb7beb27a1fdd527ded5a39eeebb54ae28f816dbf74b3a03e0ad
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral31 behavioral32

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Lokibot

Suspicious use of SetThreadContext

Tries to connect to .bazar domain

Looks up external IP address via web service

Suspicious use of SetThreadContext

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

RedLine

RedLine Payload

Executes dropped EXE

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Suspicious use of SetThreadContext

Process spawned unexpected child process

Lokibot

Beds Protector Packer

Suspicious use of SetThreadContext

Dridex

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

AgentTesla

AgentTesla Payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Remcos

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Dridex

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25