agenttesla

General

Target

f6672be987a2a11d9653fe0d0c03d2dd7e75756ac88c0cf952872afe5a3c02b1.vbs
Size

278KB
Sample

240419-cndkzadh47
MD5

a03e5551bf8b70078d614454d0443e5a
SHA1

fe998c6c6ea5dec7dea6a64ec5b859039ea376f9
SHA256

f6672be987a2a11d9653fe0d0c03d2dd7e75756ac88c0cf952872afe5a3c02b1
SHA512

7d40d8e36d4eb5091e6996341d1101997b243b0d24d15600f2c06614459c78cd830e8397e2429c804c3c5b33a919f6b596b94d82b508c9d27e25a381103b4fa2
SSDEEP

6144:LidAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOSQ8UO1FsIF:+nS2ImHIYIq6

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.myhydropowered.com
Port:
587
Username:
alabama@myhydropowered.com
Password:
I0qKSC8jilBDWGl
Email To:
lontor@myhydropowered.com

Targets

- Target
  
  f6672be987a2a11d9653fe0d0c03d2dd7e75756ac88c0cf952872afe5a3c02b1.vbs
- Size
  
  278KB
- MD5
  
  a03e5551bf8b70078d614454d0443e5a
- SHA1
  
  fe998c6c6ea5dec7dea6a64ec5b859039ea376f9
- SHA256
  
  f6672be987a2a11d9653fe0d0c03d2dd7e75756ac88c0cf952872afe5a3c02b1
- SHA512
  
  7d40d8e36d4eb5091e6996341d1101997b243b0d24d15600f2c06614459c78cd830e8397e2429c804c3c5b33a919f6b596b94d82b508c9d27e25a381103b4fa2
- SSDEEP
  
  6144:LidAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOSQ8UO1FsIF:+nS2ImHIYIq6
Score

10^/10

agenttesla guloader downloader keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2