agenttesla

General

Target

f544eba4ca4d129edc8c944d9b236ea7b92c71c0085617fb43eb3a451681c3ff.vbs
Size

279KB
Sample

240419-cm7gnadh44
MD5

4dbc97f8d5317c9d1dfacb195dbe6af7
SHA1

c50c88d61aed7ec85c31f18267bca471cf94065d
SHA256

f544eba4ca4d129edc8c944d9b236ea7b92c71c0085617fb43eb3a451681c3ff
SHA512

8a6ddaea7ce4dd6767fa309339e23b38e7f2b77e03e2d5111fe772195231c2ba09ade5a4d4def839204316d0a50d3315cdbab29d7d0e193dc8ce6fcec827b578
SSDEEP

6144:LmdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOKR8q3iQFw0:6nS2Im4WnPwp

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.electricistas-24hs.com.ar
Port:
587
Username:
contactos@electricistas-24hs.com.ar
Password:
Martin*olmos2017
Email To:
indexforwarder@gmail.com

Targets

- Target
  
  f544eba4ca4d129edc8c944d9b236ea7b92c71c0085617fb43eb3a451681c3ff.vbs
- Size
  
  279KB
- MD5
  
  4dbc97f8d5317c9d1dfacb195dbe6af7
- SHA1
  
  c50c88d61aed7ec85c31f18267bca471cf94065d
- SHA256
  
  f544eba4ca4d129edc8c944d9b236ea7b92c71c0085617fb43eb3a451681c3ff
- SHA512
  
  8a6ddaea7ce4dd6767fa309339e23b38e7f2b77e03e2d5111fe772195231c2ba09ade5a4d4def839204316d0a50d3315cdbab29d7d0e193dc8ce6fcec827b578
- SSDEEP
  
  6144:LmdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOKR8q3iQFw0:6nS2Im4WnPwp
Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader,Cloudeye

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Blocklisted process makes network request

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2