agenttesla

General

Target

2771d19509020f26e66b8af84fd8b4af0e02ded04ba73bcb9b57987f7863975f
Size

157KB
Sample

240328-bme7qsce2y
MD5

fdd319fa7de7f43c93afdff04162281d
SHA1

6512ed74b9d7dc4d425f3652e39ff4691b09c5c8
SHA256

2771d19509020f26e66b8af84fd8b4af0e02ded04ba73bcb9b57987f7863975f
SHA512

b09231c91780d4b58226862d4a02a2f310b00375ed871efae6d761e97015ba412c9df9390efb3ef0f9fddcb912ab3c4032a1cda51fd7ee422324dab97e12777e
SSDEEP

1536:gwcgVKD5XghB2jm/w7ecwOJhv9lMuEqTIm4gKN2PqAqMX3ciIAnoejei:vXVKlM7dOJCuTKNhAqimAN6

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7178103238:AAFpcijMmYeMlJJVnAmpmroCaHuSs5YlbxU/

Extracted

Family

xworm

C2

127.0.0.1:5000

51.89.241.91:5000

Attributes

Install_directory
%Public%
install_file
Adobe Cloud.exe
telegram
https://api.telegram.org/bot5474576959:AAEFEPb7hmHEmq_ZM_jasyYk46DECm44Sm0/sendMessage?chat_id=1412104349

Targets

- Target
  
  2771d19509020f26e66b8af84fd8b4af0e02ded04ba73bcb9b57987f7863975f
- Size
  
  157KB
- MD5
  
  fdd319fa7de7f43c93afdff04162281d
- SHA1
  
  6512ed74b9d7dc4d425f3652e39ff4691b09c5c8
- SHA256
  
  2771d19509020f26e66b8af84fd8b4af0e02ded04ba73bcb9b57987f7863975f
- SHA512
  
  b09231c91780d4b58226862d4a02a2f310b00375ed871efae6d761e97015ba412c9df9390efb3ef0f9fddcb912ab3c4032a1cda51fd7ee422324dab97e12777e
- SSDEEP
  
  1536:gwcgVKD5XghB2jm/w7ecwOJhv9lMuEqTIm4gKN2PqAqMX3ciIAnoejei:vXVKlM7dOJCuTKNhAqimAN6
Score

10^/10

agenttesla xworm keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2