agenttesla | 6b33dcd29a3bddb0574c50b604db51b808c0909df8beeb575fea8979ce55dd49 | Triage

Sharing

General

Target

20230328.bat.exe
Size

632KB
Sample

230330-h9jl1ada3z
MD5

57f282205cc0abd33d339ccedf0df2f1
SHA1

1cf7ba24d1157a1b4add218db224d34c2bb416dc
SHA256

6b33dcd29a3bddb0574c50b604db51b808c0909df8beeb575fea8979ce55dd49
SHA512

ed55a50893e0e1d9d5fb38343f3e7125dcb4217b9c9c16f7bc16dd3fc8db02a937ce3f9f36512b582d1bf94e5327c7505b9a9b923693b84b0c3fe0054f8caf60
SSDEEP

6144:sMm4CCHM4NL26fgvHOg3UXy5bpBUWwVl57DDCu96qvjIegLl3:sMwg/NL26fgvHOFyrKxl7vCM6qbIeal3

Score

10^/10

agenttesla guloader collection downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
oiliskim.com
Port:
587
Username:
[email protected]
Password:
Nothing4you
Email To:
[email protected]

Targets

- Target
  
  20230328.bat.exe
- Size
  
  632KB
- MD5
  
  57f282205cc0abd33d339ccedf0df2f1
- SHA1
  
  1cf7ba24d1157a1b4add218db224d34c2bb416dc
- SHA256
  
  6b33dcd29a3bddb0574c50b604db51b808c0909df8beeb575fea8979ce55dd49
- SHA512
  
  ed55a50893e0e1d9d5fb38343f3e7125dcb4217b9c9c16f7bc16dd3fc8db02a937ce3f9f36512b582d1bf94e5327c7505b9a9b923693b84b0c3fe0054f8caf60
- SSDEEP
  
  6144:sMm4CCHM4NL26fgvHOg3UXy5bpBUWwVl57DDCu96qvjIegLl3:sMwg/NL26fgvHOFyrKxl7vCM6qbIeal3
Score

10^/10

agenttesla guloader collection downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

behavioral2

agentteslaguloaderdownloaderkeyloggerspywarestealertrojan