agenttesla

General

Target

tmp
Size

340KB
Sample

240327-zfvwlsbf33
MD5

845971e68786f9c59ad9e4d5b7a2b1fe
SHA1

619a41e8a05c9f1f8aa56684e6578f9efd2acf0f
SHA256

e749697baf047ee9b5261865ffb43b8b92e77288f9d764798d00c2fd685ca573
SHA512

c00e5cc5bc66c3ef5e078330aa26d5a6c29cd76c611418c3bf16e6f1d25693974757e97cd689c7a587d9a3c4ddecf6c90bd8be7f7015d082987cdc6e1683400b
SSDEEP

6144:c8k80ckeOTFIdzXdVufRrLivwburclAp07IdY:c8k80ckeaId65LswburcypJ

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7178103238:AAFpcijMmYeMlJJVnAmpmroCaHuSs5YlbxU/

Extracted

Family

xworm

C2

127.0.0.1:5000

51.89.241.91:5000

Attributes

Install_directory
%Public%
install_file
Adobe Cloud.exe
telegram
https://api.telegram.org/bot5474576959:AAEFEPb7hmHEmq_ZM_jasyYk46DECm44Sm0/sendMessage?chat_id=1412104349

Targets

- Target
  
  tmp
- Size
  
  340KB
- MD5
  
  845971e68786f9c59ad9e4d5b7a2b1fe
- SHA1
  
  619a41e8a05c9f1f8aa56684e6578f9efd2acf0f
- SHA256
  
  e749697baf047ee9b5261865ffb43b8b92e77288f9d764798d00c2fd685ca573
- SHA512
  
  c00e5cc5bc66c3ef5e078330aa26d5a6c29cd76c611418c3bf16e6f1d25693974757e97cd689c7a587d9a3c4ddecf6c90bd8be7f7015d082987cdc6e1683400b
- SSDEEP
  
  6144:c8k80ckeOTFIdzXdVufRrLivwburclAp07IdY:c8k80ckeaId65LswburcypJ
Score

10^/10

agenttesla xworm keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2