agenttesla

General

Target

PO N°CF004303.js
Size

46KB
Sample

221125-h4dhssdh61
MD5

2d7eb6057c440a29f5665fa451e81652
SHA1

92ea018787415f08474136050bb93b440b703de7
SHA256

35f530a0947f106cbb34d04a9522109b4934bf63806f1c91c38b5f077a1c40b5
SHA512

93e6db0031e4ca133504871e937c50900a2fad66d5e0a3428a493bcf473c796912c7840e4ca05bf1b8aa4c4a2c217fece1ebd3969e2b863d6cbbd3716528b747
SSDEEP

768:NZLVEiEj4aonG/Su22Anqf54DdV48E/hcuIvGpYFbft5s:6ic4aot2qqfWfI/hcuIS8bftu

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vinadiali.com
Port:
587
Username:
[email protected]
Password:
mjuSFRU8

Extracted

Family

wshrat

C2

http://45.139.105.174:2070

Targets

- Target
  
  PO N°CF004303.js
- Size
  
  46KB
- MD5
  
  2d7eb6057c440a29f5665fa451e81652
- SHA1
  
  92ea018787415f08474136050bb93b440b703de7
- SHA256
  
  35f530a0947f106cbb34d04a9522109b4934bf63806f1c91c38b5f077a1c40b5
- SHA512
  
  93e6db0031e4ca133504871e937c50900a2fad66d5e0a3428a493bcf473c796912c7840e4ca05bf1b8aa4c4a2c217fece1ebd3969e2b863d6cbbd3716528b747
- SSDEEP
  
  768:NZLVEiEj4aonG/Su22Anqf54DdV48E/hcuIvGpYFbft5s:6ic4aot2qqfWfI/hcuIS8bftu
Score

10^/10

agenttesla vjw0rm wshrat keylogger persistence spyware stealer trojan worm
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- WSHRAT
  WSHRAT is a variant of Houdini worm and has vbs and js variants.
  trojan wshrat
- Blocklisted process makes network request
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Vjw0rm

WSHRAT

Blocklisted process makes network request

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2