agenttesla

General

Target

https://www.pwnyoutube.com
Sample

240519-cwgycsdh47

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

JCu13Amkvl9z4dd1

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  
  https://www.pwnyoutube.com
Score

10^/10

agenttesla xworm agilenet keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- AgentTesla payload
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Uses the VBS compiler for execution
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm

AgentTesla payload

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Uses the VBS compiler for execution

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1