agenttesla

General

Target

94d61fddb03aabe9c5ffe7ac30b1020023242a9e95ce23d05230b76e4d85f9a7.vbs
Size

278KB
Sample

240419-b4jw9adb34
MD5

272f0c8fedadc092062ad743782b1434
SHA1

e4502aa04ceb7b65e4bb7f6a7cecc1f36677e69d
SHA256

94d61fddb03aabe9c5ffe7ac30b1020023242a9e95ce23d05230b76e4d85f9a7
SHA512

d70bc698f6619dbf882a7952750f2dfb3a0ae9625c6a9c35803093750ce102d1ac14f7db0d3ab1afde8770179d81d497ded907332b186bf6dc3454dc8559a352
SSDEEP

6144:L7dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOmR8NAKVwFO:fnS2ImeAFhRt

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.myhydropowered.com
Port:
587
Username:
abbafather@myhydropowered.com
Password:
FczQrYLPEFEXumG
Email To:
waymaker@myhydropowered.com

Targets

- Target
  
  94d61fddb03aabe9c5ffe7ac30b1020023242a9e95ce23d05230b76e4d85f9a7.vbs
- Size
  
  278KB
- MD5
  
  272f0c8fedadc092062ad743782b1434
- SHA1
  
  e4502aa04ceb7b65e4bb7f6a7cecc1f36677e69d
- SHA256
  
  94d61fddb03aabe9c5ffe7ac30b1020023242a9e95ce23d05230b76e4d85f9a7
- SHA512
  
  d70bc698f6619dbf882a7952750f2dfb3a0ae9625c6a9c35803093750ce102d1ac14f7db0d3ab1afde8770179d81d497ded907332b186bf6dc3454dc8559a352
- SSDEEP
  
  6144:L7dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOmR8NAKVwFO:fnS2ImeAFhRt
Score

10^/10

agenttesla guloader downloader keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2