agenttesla

General

Target

https://mega.nz/file/FKVVRDKa#hjzYn8cTZKkNmb9fojMy_bQECNq8eEpwV1CEF6TGbK0
Sample

240531-qw8mzaah93

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes

install_file
USB.exe

Targets

- Target
  
  https://mega.nz/file/FKVVRDKa#hjzYn8cTZKkNmb9fojMy_bQECNq8eEpwV1CEF6TGbK0
Score

10^/10

agenttesla xworm agilenet keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- AgentTesla payload
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Uses the VBS compiler for execution
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm

AgentTesla payload

Executes dropped EXE

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Uses the VBS compiler for execution

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

urlscan1

behavioral1