Overview

overview

10

Static

static

3

tmp6x00xzqq.exe

windows7-x64

10

tmp6x00xzqq.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp6x00xzqq

  • Size

    701KB

  • Sample

    240523-zjq2tsfg46

  • MD5

    cd46396fa20831c4ec0acea6534d020f

  • SHA1

    1736c61d635cc61d8e9ec6b0dd15ddf814657fc5

  • SHA256

    c90f02f4c4f58772131c5fc1b8cc8acc647005189e1abd87ecae379a41b0eac8

  • SHA512

    b40e2fe2faab4a4faf3c6e82cd778868fb275e41b55f40a6f566eecab23aac42e0956b261b124c47849bcc8d6a4809192c5ec21e301d8d513b9391571b7cdc91

  • SSDEEP

    12288:Cvp1DrAkngRmfxs7ZsGYAG5utPHH9oTHhwOR6bu:enDrA/mfWZsGY7+0ho

Score
10/10
agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      tmp6x00xzqq

    • Size

      701KB

    • MD5

      cd46396fa20831c4ec0acea6534d020f

    • SHA1

      1736c61d635cc61d8e9ec6b0dd15ddf814657fc5

    • SHA256

      c90f02f4c4f58772131c5fc1b8cc8acc647005189e1abd87ecae379a41b0eac8

    • SHA512

      b40e2fe2faab4a4faf3c6e82cd778868fb275e41b55f40a6f566eecab23aac42e0956b261b124c47849bcc8d6a4809192c5ec21e301d8d513b9391571b7cdc91

    • SSDEEP

      12288:Cvp1DrAkngRmfxs7ZsGYAG5utPHH9oTHhwOR6bu:enDrA/mfWZsGY7+0ho

    Score
    10/10
    guloaderdownloaderagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      0ff2d70cfdc8095ea99ca2dabbec3cd7

    • SHA1

      10c51496d37cecd0e8a503a5a9bb2329d9b38116

    • SHA256

      982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

    • SHA512

      cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

    • SSDEEP

      192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      01e76fe9d2033606a48d4816bd9c2d9d

    • SHA1

      e46d8a9ed4d5da220c81baf5f1fdb94708e9aba2

    • SHA256

      ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70

    • SHA512

      62ef7095d1bf53354c20329c2ce8546c277aa0e791839c8a24108a01f9483a953979259e0ad04dbcab966444ee7cdd340f8c9557bc8f98e9400794f2751dc7e0

    • SSDEEP

      96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks