agenttesla

General

Target

be1519bcbdb5a58fb2bb3ab5dd51ae1f.exe
Size

232KB
Sample

230330-scqn6adb46
MD5

be1519bcbdb5a58fb2bb3ab5dd51ae1f
SHA1

ba25e963f2c56380d82188203aec956dd2c81a91
SHA256

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d
SHA512

efae646f8238a389e207f063e7f3ae8819caf151c72db290e08c8c0ef820d03dbd3d680861c510d4083f1cc3d3250d07d134768bac5c2d205a372f4fc0b3532f
SSDEEP

6144:+PX7iNebSdJ8DckdV+opbGA5Siwrd987k:5PYckdbGmSiwBH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6090824543:AAGDjc8qY74kVvTCL6JGfHdJaauZXSH2oek/

Targets

- Target
  
  be1519bcbdb5a58fb2bb3ab5dd51ae1f.exe
- Size
  
  232KB
- MD5
  
  be1519bcbdb5a58fb2bb3ab5dd51ae1f
- SHA1
  
  ba25e963f2c56380d82188203aec956dd2c81a91
- SHA256
  
  5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d
- SHA512
  
  efae646f8238a389e207f063e7f3ae8819caf151c72db290e08c8c0ef820d03dbd3d680861c510d4083f1cc3d3250d07d134768bac5c2d205a372f4fc0b3532f
- SSDEEP
  
  6144:+PX7iNebSdJ8DckdV+opbGA5Siwrd987k:5PYckdbGmSiwBH
Score

10^/10

agenttesla guloader collection discovery downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader,Cloudeye

Checks QEMU agent file

Loads dropped DLL

Accesses Microsoft Outlook profiles

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2