agenttesla

General

Target

f661588bdec3197564fa50c785121022bf91774eab1ff79108ecf9404eb0aecc.bat
Size

7KB
Sample

240425-cmh43adf5x
MD5

da503f6a9d9306ac4645857e575e7d3d
SHA1

3241d9a60b626a1afa12bdc037066f094d644488
SHA256

f661588bdec3197564fa50c785121022bf91774eab1ff79108ecf9404eb0aecc
SHA512

caec233361b6029bdcffc8cb712083800eaa14dffe4eca2f404eb331a74d9e686634fa5722086de47d3fffd54b62ae7cbcc7a28d95a075f35184975076a55236
SSDEEP

192:yHSonigCNy6+hEkb2DicnznGQ7k7DlKmZoESibXDneDc:g+Fub2fGNlNOH6yc

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cash4cars.nz
Port:
587
Username:
logs@cash4cars.nz
Password:
logs2024!
Email To:
officejay@yandex.com

Targets

- Target
  
  f661588bdec3197564fa50c785121022bf91774eab1ff79108ecf9404eb0aecc.bat
- Size
  
  7KB
- MD5
  
  da503f6a9d9306ac4645857e575e7d3d
- SHA1
  
  3241d9a60b626a1afa12bdc037066f094d644488
- SHA256
  
  f661588bdec3197564fa50c785121022bf91774eab1ff79108ecf9404eb0aecc
- SHA512
  
  caec233361b6029bdcffc8cb712083800eaa14dffe4eca2f404eb331a74d9e686634fa5722086de47d3fffd54b62ae7cbcc7a28d95a075f35184975076a55236
- SSDEEP
  
  192:yHSonigCNy6+hEkb2DicnznGQ7k7DlKmZoESibXDneDc:g+Fub2fGNlNOH6yc
Score

10^/10

guloader downloader agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader,Cloudeye

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Blocklisted process makes network request

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2