agenttesla

General

Target

transferencia........vbe
Size

86KB
Sample

230207-v65raach97
MD5

6dbc4b8acb26300c2246e753f18f482a
SHA1

403df794c6e9ce3e538a9eb020228dd68e18b97b
SHA256

b8d50e753171579f486f0f2aa2a2c10a1d11f785c78c257647a6e5cb62ec7fe7
SHA512

51bc5a32c8549fe81dd00631ba839510836e3e7a78e05aff7427ec98108235f2f4dc57fb1da8c97ca71840f9e9d0820715cb48d3191e4b4b39ecf576d46214b7
SSDEEP

1536:QA/mpA5Ob+jb52SAUmzk3iTY/Wxfi0PS6LW1XHp4ASi:n/iyE0b5wUmzk3iTY+xfi0PS6QXJki

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=1O3Zw7SOdJi4Uk954KNGkDYsHyL37GOzq

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.1and1.es
Port:
587
Username:
[email protected]
Password:
628242ailatsaC
Email To:
[email protected]

Targets

- Target
  
  transferencia........vbe
- Size
  
  86KB
- MD5
  
  6dbc4b8acb26300c2246e753f18f482a
- SHA1
  
  403df794c6e9ce3e538a9eb020228dd68e18b97b
- SHA256
  
  b8d50e753171579f486f0f2aa2a2c10a1d11f785c78c257647a6e5cb62ec7fe7
- SHA512
  
  51bc5a32c8549fe81dd00631ba839510836e3e7a78e05aff7427ec98108235f2f4dc57fb1da8c97ca71840f9e9d0820715cb48d3191e4b4b39ecf576d46214b7
- SSDEEP
  
  1536:QA/mpA5Ob+jb52SAUmzk3iTY/Wxfi0PS6LW1XHp4ASi:n/iyE0b5wUmzk3iTY+xfi0PS6QXJki
Score

10^/10

agenttesla guloader collection downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Blocklisted process makes network request
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Guloader,Cloudeye

Blocklisted process makes network request

Checks QEMU agent file

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2