agenttesla | 23e06f8822165853f973fd3414cd084027e1181fecb7fa15d791c22bc35531fb

Resubmissions

07-04-2024 11:37

240407-nrb24abg9x 10

09-10-2023 19:06

09-10-2023 19:00

09-10-2023 18:59

01-10-2023 10:08

Sharing

Copy URL

Twitter E-mail

General

Target

XWorm V5.0_Cracked.7z
Size

27.5MB
Sample

231009-xnxn3ahg55
MD5

e6743502f4ad1335730e2f4f932f7740
SHA1

b61123869957ea3e903c6dc103da9d0387ba66f3
SHA256

23e06f8822165853f973fd3414cd084027e1181fecb7fa15d791c22bc35531fb
SHA512

658ac3984f072c9d4e612a7f0ef10ba394845e7343ffbbb9558e346e96d3a2fb7e92f399e5449206d0b5c0cc25798b1dbeb5e14b9d752bb69c91ad50d4238373
SSDEEP

786432:dqVTpgbD+4a7JoI5Bny9ukqA+udgdiQOkLrdE06aOu1MU3z:WgbD+XeGny9uuPN+rdE0FHx3z

Score

10^/10

Malware Config

Targets

- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Mono.Cecil.Mdb.dll
- Size
  
  42KB
- MD5
  
  1c6aca0f1b1fa1661fc1e43c79334f7c
- SHA1
  
  ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
- SHA256
  
  411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
- SHA512
  
  1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
- SSDEEP
  
  768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
Score

8^/10

discovery
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Mono.Cecil.Pdb.dll
- Size
  
  87KB
- MD5
  
  6d5eb860c2be5dbeb470e7d3f3e7dda4
- SHA1
  
  80c76660b87c52127b1a7da48e27700f75362041
- SHA256
  
  447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
- SHA512
  
  64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
- SSDEEP
  
  1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO
Score

1^/10
behavioral3 behavioral4
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Mono.Cecil.Rocks.dll
- Size
  
  27KB
- MD5
  
  6e7f0f4fff6c49e3f66127c23b7f1a53
- SHA1
  
  14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
- SHA256
  
  2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
- SHA512
  
  0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
- SSDEEP
  
  384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
Score

1^/10
behavioral5 behavioral6
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Mono.Cecil.dll
- Size
  
  350KB
- MD5
  
  de69bb29d6a9dfb615a90df3580d63b1
- SHA1
  
  74446b4dcc146ce61e5216bf7efac186adf7849b
- SHA256
  
  f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
- SHA512
  
  6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
- SSDEEP
  
  6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
Score

1^/10
behavioral7 behavioral8
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/MonoMod.Backports.dll
- Size
  
  138KB
- MD5
  
  dd43356f07fc0ce082db4e2f102747a2
- SHA1
  
  aa0782732e2d60fa668b0aadbf3447ef70b6a619
- SHA256
  
  e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6
- SHA512
  
  284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e
- SSDEEP
  
  3072:kRu+JWxtm5UE1cy/4HJW/SwUif9T2FpsP3Y+RJgv:kRTJWfNE1CuSMlTIeTRm
Score

1^/10
behavioral10 behavioral9
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/MonoMod.Core.dll
- Size
  
  216KB
- MD5
  
  b808181453b17f3fc1ab153bf11be197
- SHA1
  
  bce86080b7eb76783940d1ff277e2b46f231efe9
- SHA256
  
  da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd
- SHA512
  
  a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3
- SSDEEP
  
  6144:mV+Fj3NL3NdYIRTdJ3AdHwSOTboZK3MYt:hFj3NL3NdYIRTdJ3AdHp2
Score

1^/10
behavioral11 behavioral12
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/MonoMod.ILHelpers.dll
- Size
  
  6KB
- MD5
  
  6512e89e0cb92514ef24be43f0bf4500
- SHA1
  
  a039c51f89656d9d5c584f063b2b675a9ff44b8e
- SHA256
  
  1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0
- SHA512
  
  9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b
- SSDEEP
  
  96:XC5172VL9HZNBrfq7LgcA6S8I2DqDXGnADX62WuauAuRt/0:q8xDfYLgcAMtAXG+rPVL/
Score

1^/10
behavioral13 behavioral14
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/MonoMod.Iced.dll
- Size
  
  623KB
- MD5
  
  c24584c6b5bc57ac46727ab15e332c4a
- SHA1
  
  dadd68f0fa45845fbc30fd0f8f54e8616cdd2d0b
- SHA256
  
  ef4a8f28226db390dd07de13afc01c8000e127c978ebf428a6637f39ac277033
- SHA512
  
  aabc699eef08e3483049c7ceb48842deddc52284de7f6f72d56d6eccac3989cc373839aeac61f03e7b2af203744d579fd96a4eb911cfdd0461b151c41dc6771d
- SSDEEP
  
  6144:Xw98C3SQzlfuStslPYAH+jUmLdf26bfDcj2511Qxu7F:q8CCYlfuGslPn+jvDTDcj251+xuR
Score

1^/10
behavioral15 behavioral16
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/MonoMod.Utils.dll
- Size
  
  319KB
- MD5
  
  79f1c4c312fdbb9258c2cdde3772271f
- SHA1
  
  a143434883e4ef2c0190407602b030f5c4fdf96f
- SHA256
  
  f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a
- SHA512
  
  b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9
- SSDEEP
  
  6144:9gPf7SkKpBmBEKFutWL7dyywUQ1MWWavAsXjb:q7Svp8EtO49N
Score

1^/10
behavioral17 behavioral18
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/NAudio.dll
- Size
  
  502KB
- MD5
  
  3b87d1363a45ce9368e9baec32c69466
- SHA1
  
  70a9f4df01d17060ec17df9528fca7026cc42935
- SHA256
  
  81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- SHA512
  
  1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP
  
  6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
Score

1^/10
behavioral19 behavioral20
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Plugins/ActiveWindows.dll
- Size
  
  14KB
- MD5
  
  bf9b4e4f549e35cf35fcef4732974cb5
- SHA1
  
  474f360b4dd138ba53d1dc9f443758933883922a
- SHA256
  
  e39fc3003440b0838cd7c0454f2461d95c2c9b9e6886fe346557991fcf3f4e73
- SHA512
  
  358b9cc11199d64e52aa46c2c63afce01556fead15cc8c01a898b1a97c4238d832b8894a33866020173e9358543f88f6fea0e57c44e313cb3ba6bb7ef29f0b1e
- SSDEEP
  
  192:MpsFElxHxzCXorWcsvaUJwfdBuo1I5+3gqT8AO1tW9Yr6IW1GXZ3+ew7EDmSLOb:DFELRzbrUw/AodT8ptsY7XZ34ED8b
Score

1^/10
behavioral21 behavioral22
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Plugins/All-In-One.dll
- Size
  
  4.8MB
- MD5
  
  540d637da9254ebb6d47324014ef3857
- SHA1
  
  af168621773eef426bd0ff7313421a56702b6cef
- SHA256
  
  dd158430cfe991f17a14fac748934f38079718572a8729fe20935738c1ddaa72
- SHA512
  
  9bf869b60baa6c60bb6f2c247ce5a55ab3e901ff3f01957f0a6f5283789d602aa00a881f29f14953f020c9f8f7c18bb54d05fe05bde981360e86ab8b12b50ea8
- SSDEEP
  
  98304:tl19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:d9FPRkC8C9OH7c2ilInz0kfVo26Wsd
Score

1^/10
behavioral23 behavioral24
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Plugins/Chat.dll
- Size
  
  18KB
- MD5
  
  26c9be1bb1475d04ddad32a0bda24c0b
- SHA1
  
  5f599f419def5ac239111f61003c64ee15b5e6a5
- SHA256
  
  991adcda2cb9e53fc562f653b7c88e14fffc9ef97c4dcba1b7eda4566106a6c5
- SHA512
  
  6cfd4a995b797b22356040eec9f5a8314862062b60de5f89c4f11592844533a8be5a6061f5d597fa37dae260f21d195df7486c6ce6fe705b2c8343f34e7baf42
- SSDEEP
  
  384:mUeRbCtl+SLFxdQ0C7sKmsfcrwTKvh6GIKoIAfWUWmf9:F4SpxaoKmJr0pIAfWXO
Score

1^/10
behavioral25 behavioral26
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Plugins/Clipboard.dll
- Size
  
  14KB
- MD5
  
  c514355155a17531999bdd5e382167fd
- SHA1
  
  b84bf384a2d22c2c4e616fc7b2af3227d5eb7e01
- SHA256
  
  5bd31830605b3a389456cc2c373d0d07d5bdcc21b1713806af9a2c9803d264fe
- SHA512
  
  7f5058405b491fcd76fbdb93a42fbd3dbd46f0531444210b1e1be7788e8ceb89e9ab8ed07cb76a3d32e2012217ec3114f724d7d20b9159d097bef22046b06fbb
- SSDEEP
  
  192:f+e2PZKYnw/LzXsJ0zzBa70OFXgNTer149iY6IW1mX/60eCCWk7RSLWMU:p2ZE3sJ0ha70USTe5Wi2X/6TjMU
Score

1^/10
behavioral27 behavioral28
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Plugins/FileManager.dll
- Size
  
  678KB
- MD5
  
  e67c3a3f676f9446d19c7ca003b5ecf0
- SHA1
  
  c555beef3a7a41039319fd48e9f18becd312f9e5
- SHA256
  
  e328c16ee5b6657210be11026baefaaf9ef7c525d2973ae245d24694f0fa6a48
- SHA512
  
  4fc37c92baafde41bf5e0173f89e3c1ad49358a6fdaff0d49d7c6c31cc9cafdc93c207856ec50de5528212b67464761192eacc5b547fd422673b12252efa6819
- SSDEEP
  
  12288:8AEUQD2M5moOUK1k69TUVSwg2waA1tS5sz9P:9XM5moOUK1k69kSw216s
Score

1^/10
behavioral29 behavioral30
- Target
  
  XWorm V5.0_Cracked/XWorm V5.0/Plugins/FileSeacher.dll
- Size
  
  478KB
- MD5
  
  405f2771409e90a4bb93ed4d9aa06f1e
- SHA1
  
  64fa9363795f2b235dc0d4337e1bc678b10b0836
- SHA256
  
  65f22d8fe8d4eb97c081c938a8627d25911b6d29379a95136abd0653f9b2c0fd
- SHA512
  
  63e8ac5bf334dddd22fa1b9f434dca5f16d104a54d98cee7dd138e5387416c7645e0819da823523fa83a73d02773806925296346138d9a7ee03f27a343b94a28
- SSDEEP
  
  6144:K88L5lWTUVRTw/l97teGtSV41QJDsTDDh0Yhe6dwxLV/tuhgpn5YWRBI+WR:LzTUVRTw1lS4Ys50ie6Cf4gpts
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32