agenttesla

General

Target

Copy#0700181203.7z
Size

101KB
Sample

240514-rg86maad2v
MD5

d9c07a8078e0d378f6a60edca8b24965
SHA1

46c70837397568fb5f9d5ca9b39e266daec76fcc
SHA256

97252ce52f0d5e32b8e73b8f224539d8eb04dcf7d4ce92e84deccad49656aebd
SHA512

1260d5d7f73b20e48dac15e56eda3f716fd47ed653783659bc66f4b05834709e862dad32a13a1395e1f9d24e45cb2757a7dc1f0adad250e77b9b3cf3f3fc7778
SSDEEP

1536:3EVqtYmGBGRGIIMZ5cbU/EP55aPkst7x61+1MdUOwRuJP0oSZo3RSTRGy3K8KaaF:3FtYmGBaN5oU/I55aPk+qFzSTgy3T9oH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

94.156.65.181:5353

Mutex

4EV9DEZhSiEuj72Q

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Extracted

Credentials

Protocol: smtp
Host:
66.29.151.236
Port:
587
Username:
[email protected]
Password:
fn26k5c7Q846

Targets

- Target
  
  Copy#0700181203.exe
- Size
  
  307KB
- MD5
  
  3a7ad7df17d52faa30c9267d8993c052
- SHA1
  
  20babf125ffdc301bc7670817f8123af61ff0940
- SHA256
  
  a3d1e36ffb22746489c9932108842ef58d71c86c5a01bade59d1f0f9cbe2fde4
- SHA512
  
  6d7d7ea7a3310c7cc768556126f710d21f2dc500c5287613a35ba020a0b0ec5f85101c27068c2dc4ef94135e6228aec7501ceba123ebbd81891467ebfa37cbb8
- SSDEEP
  
  3072:qvBGLqxexlS+I3lPE6MPYUNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12g:qvwpkqBstvLGtELbMUTKZIH
Score

10^/10

agenttesla xworm zgrat keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect Xworm Payload
- Detect ZGRat V1
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2