agenttesla

Sharing

Copy URL Twitter E-mail

General

Target
231107-bz5yxsbb62_pw_infected.zip
Size 198.7MB
Sample240107-w3ew5aceh9
SHA256 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8
MD5 ddcebc8ed5bf63482fa43256738ababa
SHA1 4d4dc2548b990fa958d4f7f6628c2e4e1d5d1bca
SHA512 6aa9b10beaead4abd9404b5cb63e7214748127ef5f3e7d89929a70b534c4d98633fee7fd6b8082feac806f540128d08d152cb763383a0bd8c2b6ab19554b2eef
SSDEEP 6291456:rW9ezadSq+3+rgYYQFO8G8W0a8cvsny/mvvLwpJzX0:MBs+vU8nNy/tHk
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

raccoon

Botnet

5ba094fed1175cc7d1abb03fa165c23c

http://79.137.207.53/

Attributes

user_agent
901785252112

xor.plain

Extracted

Family

privateloader

http://45.133.1.107/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
51.178.186.149
http://45.133.1.182/proxies.txt
45.133.1.60
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
37.0.10.237

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Extracted

Family

socelars

http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.znsjis.top/

Extracted

Family

stealc

http://robertjohnson.top

Attributes

url_path
/e9c345fc99a4e67e.php

rc4.plain

Extracted

Family

nullmixer

http://hsiens.xyz/

Extracted

Family

gcleaner

ppp-gl.biz
45.9.20.13

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.tecnosilos.com.py
Port
587
Username
[email protected]
Password
38q{r,bs)M;E
Email to
[email protected]

https://discord.com/api/webhooks/1169917901906653224/YjkyFWX_CawSIPQ02zeV3XExHGtDteoh-fLuvdqIFqL772Pb__cJUtnVv4DqDRhm0ks1
https://api.telegram.org/bot6857395601:AAEr0Ki03_UqNs4qlOxRNOhnjU8odyo6de4/

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://peruglobo.com
Port
21
Username
[email protected]
Password
YSw&oCV&c23w

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

redline

Botnet

194.104.136.5:46013

Attributes

auth_value
9491a1c5e11eb6097e68a4fa8627fda8

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

135.181.129.119:4805

Attributes

auth_value
b69102cdbd4afe2d3159f88fb6dac731

Extracted

Family

lumma

http://zamesblack.fun/api

Extracted

Credentials

Protocol
smtp
Host
mail.subvijay.com
Port
587
Username
[email protected]
Password
JaiMataDi2209

Extracted

Family

redline

Botnet

pab777

185.215.113.15:6043

Extracted

Family

vidar

Version

40.3

Botnet

https://lenko349.tumblr.com/

Attributes

profile_id
706

Targets

- Target
  Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
- Size 5.6MB
- SHA256 0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd
- MD5 a121db3e0809289a5c41c44958ff6fa0
- SHA1 fd40bbe6eaeea4004046f65a8c647fabb35e1742
- SHA512 0e4af224ea67c07bdce0bae3b4040d900e2c011557ef55d8d0e68d596826561a8d4f3b553cc3290cf60e87ccee975deb65c1de9553fabfee5f67268935d8081f
- SSDEEP 98304:JVw5AxSbnFouWDC50KmHeIQT8ZVK+zoN3aZdKfFEqsJtn05C5H+ZB3pjHOR:Ja5AeFeC5UH5a87/oN3aZdKNyxeCH+ZY
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gcleaner nullmixer onlylogger dropper loader fabookie privateloader redline sectoprat smokeloader socelars ani pub5 she aspackv2 backdoor infostealer rat spyware stealer trojan
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- OnlyLogger payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
behavioral1 behavioral2
- Target
  Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
- Size 349KB
- SHA256 0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f
- MD5 0f3e1e309ee9dae28670d40e495566c1
- SHA1 869988a2a32e1d83425fcf4b9ccc946368ac4768
- SHA512 e25017d98af6bd527d200fcc5b0077c33b6610cfecbff68312abba21b0e0ab3dea208dd37de73705ba3210bf76cc1fd4148c943e9a64bbc05b16b8a099ff6dd9
- SSDEEP 6144:t7s78K51VhaZ0zc9in+ZExwHNnIjKlMstZvF9w8kZelBs27dU:i8mhaqzkcxW0KmsXtTgelBs27m
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
- Size 762KB
- SHA256 1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695
- MD5 3e9a543b85c85a0b808902b0b6cef9b2
- SHA1 29d589b838b4e1a5e54a6bfe52da0d5859609865
- SHA512 f212b3a2f4c25701df3f41be93c13cf9a6a84e1affd4e8b0f7b9fb5bc0689a1b3a1c55052c99fca314f540199997a8c265f9f447fe8b013a085a199a7fffb3c6
- SSDEEP 12288:aHW7TohIU2CoLBPdV+GLBOeUjYb9qUp5jlnRLm5bvL2z4is:a27SELNdYGL8eUjYbMUp5RnRLm5LLw4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
- Size 3.2MB
- SHA256 1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2
- MD5 f23a2c6dfaeceefb067b42df7b09c2e5
- SHA1 77f744dc208d542f438bae3dc97398c769dffc90
- SHA512 9020004b0b77aaf9ee6b6429763c19b7a2360ee06835cb5bed9a1b724241752ac5f1c9013346bf8971d6dd217495e71b59ee423830e13f3c9dc1bdb6cced6028
- SSDEEP 98304:xQCvLUBsgjDAzKDFW/1+Y6MojWEpww/CPJs:xtLUCg4QFi/olpww/CRs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

fabookie nullmixer privateloader redline sectoprat vidar 706 pab777 aspackv2 dropper infostealer loader rat spyware stealer trojan
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8
- Target
  Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
- Size 4.9MB
- SHA256 2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c
- MD5 f81a0abe9131fdd7a1d535dbab8e5451
- SHA1 3226bdbf0df5318609c7fd03453aa5c97636d89a
- SHA512 7adf59348b9846406b89a3d497a6e92e565ed5ad5fbba1af22b427fb12d76980e18f33b7b39ac0ac0c0becc28fac603795fc427dd2c2ddaca1ff736e10531f96
- SSDEEP 98304:7hgMyAGrNbegrraSASKPZml0Vq2t0NLUgja3onb+Yi8Omh:NgMyACpDranrXUfNLtAbY4mh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma stealer vmprotect
- Detect Lumma Stealer payload V4
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral10 behavioral9
- Target
  Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
- Size 253KB
- SHA256 2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8
- MD5 09e6dc2b8078d3dd8f661b718bfa1b51
- SHA1 0179a6d09224b0f764140218af8005d3d253966b
- SHA512 884540c36743c7488c3e117e41319e9abe48a0af708c27336550dea6a387d4d3f16970417f9b5b49d3ec11bb1872e0e7d0d2ea4a4f42af25a27995297ba6f15d
- SSDEEP 3072:cFRNd9JnGLn/tFCmpnnbTLQ8lHVvJ+5vxjyOgPBWQeNUtlkq5X+blVEf:mRNd9tGLnlFJpnbTLQ8JWp+OQFtt+DI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
behavioral11 behavioral12
- Target
  Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
- Size 771KB
- SHA256 2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f
- MD5 7f76661ae3b0692fb7e422b5d6094fd0
- SHA1 0e3c626cd190ae02fc3addecc83927076a34802a
- SHA512 693a826997a6ecde662d41919a39b87cc64bef31adc06c108f61d8415fd410a1f87ad62b9cbc6e3ca223ee0f72b117fdaaa39ae6d2c067de62617a0da6162669
- SSDEEP 24576:yCzbiITNmDIdUatqhV5OqRFJeeXYJbGEfE:Xzbi8pqhbvXYJbGs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral13 behavioral14
- Target
  Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
- Size 39KB
- SHA256 3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a
- MD5 815996cd5d7442c707261c1b30dd1042
- SHA1 fd331e80c76444662ec0947e591441ec97ca1dfa
- SHA512 aedd19e77f7750b46ad847debc483c46237d83f9f96be9a5b3793c8c63eecdc49699c568dc2d4217c6762d9ad0679771cea4e730bb24c673953dbaf4342b65e7
- SSDEEP 768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/G7:ZzFbxmLPWQMOtEvwDpj38lD/q
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
- Size 298KB
- SHA256 3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5
- MD5 eb19ddb285085033d7b220c1feedb275
- SHA1 ac869d17200d9bab4b0006de63aa73c099d4c4f1
- SHA512 2a75477909d93b7ff32c82a82d02811e762d163b51389d66cecd121af6becf568f0419ef1540b0c73853551cce4090ed5f0e9cbeac44716d983a93fa1602b280
- SSDEEP 6144:HVlCXpK0gtQfDFf8834rj1MJ6/57r7q5OePseHiE3Vw9JZNE:1lCXpH7J883wZu6/lfq5OeFByJPE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
- Size 742KB
- SHA256 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4
- MD5 6a5599535b36e8f4c9b6ee93fbac5d7b
- SHA1 ef2d05734be03c9daa29b18aff428204770ba57c
- SHA512 ea8a9ee60f3160c3b55c6b2b1527b74bd36bdf50ad63cbf74d4bc83b1b45010dfa7620d73482fc55bd7ff717b90726b14fe327828c69dbdf457795630f8a6e5e
- SSDEEP 12288:NRFk2DLWEHmW2JnRLFlTj99JkI7oyCKYJQSUlO3RmJzY3Kk0J562LAcjgSx9ilp1:7CtFJj9cIxNuXo5zAfs9u/hH9H
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral19 behavioral20
- Target
  Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
- Size 82KB
- SHA256 3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3
- MD5 8f84d63772a6cf26c6347dcf84f8152e
- SHA1 5fd02e0feca98db01fd4a08dec8706dbf5c48645
- SHA512 bba2ba53df1b2cd85f1170dd6803bdd9b05f1c046b3df116e80bfa4cee7157821a1f28e6b8d6bb5fbb3003301a3d06a11d2e31e8a9e03556bb2f8eeb6b81263d
- SSDEEP 1536:ZzFbxmLPWQMOtEvwDpj386Sj/Rs580gizi:ZVxkGOtEvwDpjc3
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral21 behavioral22
- Target
  Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
- Size 8.3MB
- SHA256 3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7
- MD5 a2d3e4fd65182c4ca56f1ec78131acc5
- SHA1 baab9ae70a2df25c3692886fe031e8d26080aeb7
- SHA512 31726ede8167e38cf71d17107098bbf806294fb2f1c64da237f583691e2e6d35f293130c8e1ccea37fbe9af07cbd2f71379a902cc7c3e0cd80c7c0e65c5e6357
- SSDEEP 196608:ErV67DFXZM2t60xR4UbC1m94O9A9ddFq/gnR:EkFXt/RbbCY9B9AfmYR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma stealer
- Detect Lumma Stealer payload V4
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral23 behavioral24
- Target
  Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
- Size 751KB
- SHA256 4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26
- MD5 eddf2a07df11d98e37544ea249a3d86f
- SHA1 de40acaeb9a15ed6929f1a3cdc20fc5dac6e1690
- SHA512 07ab5c45cf51778bf775c317345a123cf0f79cc4ed3f39d9a39a8232d733b96bebd2ed49ed5d73eaee821e93085fc34ad55de27208a825893c9ac4c8a1fac713
- SSDEEP 12288:URFk2rLWhFJ6pdluOcI8O2rruxS8acVKBjM9giDQTX/bZIMlPmvfdSLNifF6xWqm:wCtWcVrub2jF7ble3dSLAN6sqZ1EtD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral25 behavioral26
- Target
  Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
- Size 940KB
- SHA256 5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a
- MD5 87fadafde153ec4d73a358c4897e54e6
- SHA1 1745ada809a9e80f80ce8a38d2bb5858378a4206
- SHA512 15331c1964c1abfcdd31e2c3b40a744b0e33bf7df5c9749be1047d384cf5d34e86655d16fba2601156c56178b8f0e3e90405a70bd22d2f5794ff948c16881b88
- SSDEEP 12288:RCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgagHCZu8i7iq:RCdxte/80jYLT3U1jfsWaqeHfQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
- Size 1.7MB
- SHA256 5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91
- MD5 fee771c9a50a56880f6bce04874f6f5c
- SHA1 e5a9f281eb91405004cd4f347db7b5f23f8d6b8f
- SHA512 e1cb760ddc11d2eeba73fd5bd3baabcebc82c7f41ed9a7cc2d7e30bf527ac6aaf3593536a57c3ac546ecf29b1521764f0412062a811645d0bbcf739ca579f422
- SSDEEP 24576:3eHTg0cKA71b0+P7tT4o+AVDT2wEpXs+XFJP+jP2jetVS7cb6z54R7u9ud9Xu9cI:3TrTqAVm/JRX2IetVz6mRuaxt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma stealer
- Detect Lumma Stealer payload V4
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Executes dropped EXE
- Loads dropped DLL
behavioral29 behavioral30
- Target
  Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
- Size 572KB
- SHA256 10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4
- MD5 83bcd5d811db9cbd752872045a6adc88
- SHA1 2307fc3e1bfdd0b4a3bbdd675e4e069506f99d88
- SHA512 af7c8334de95f8c5ab16baa27ec2973318a9602f622188452b614316970af753a2d031bea2e86deee90d456b831adae6e0c7bb57a3333e4045e18feee770f167
- SSDEEP 12288:eIktQbNKU6ZUyABErB5f524FWYefpA00L4zrm7PHs:e2Z76HBR8fYIdm4/g/s
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detect Fabookie payload

Fabookie

GCleaner

NullMixer

OnlyLogger

PrivateLoader

RedLine

RedLine payload

SectopRAT

SectopRAT payload

SmokeLoader

Socelars

Socelars payload

OnlyLogger payload

ASPack v2.12-2.42

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Looks up geolocation information via web service

Snake Keylogger

Snake Keylogger payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

Detect Fabookie payload

Fabookie

NullMixer

PrivateLoader

RedLine

RedLine payload

SectopRAT

SectopRAT payload

Vidar

Vidar Stealer

ASPack v2.12-2.42

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Detect Lumma Stealer payload V4

Lumma Stealer

VMProtect packed file

Stealc

AgentTesla

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

AgentTesla

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext