agenttesla

General

Target

XWorm v5.6.rar
Size

39.9MB
Sample

240715-mexmla1gnj
MD5

0fcefb0e589d6b2b2b6dd4da075f4526
SHA1

1d858a4179531afe64e3ef5cc2a6cc40f5ad0981
SHA256

ed24079ff53c18d2ba5f45e9b314ff04d60511afe9c61d73d355842781c8402d
SHA512

e5ec72c9046ced32e2937a9ee787a8f0dd881c15582f79558dc2a2279641e32f407e258995327dfb061c3f05139e8d43d01adc5e88f95bf456c925d7191c6878
SSDEEP

786432:vqko5L5Xsni3Uw7ldymrQLmKUCKBvJK29+gTOpjtkuXIzP6QQ:vq/5L58twb5rcAvVoppHXMPhQ

Score

10^/10

Malware Config

Targets

- Target
  
  XWorm v5.6/XWormV5.6.exe
- Size
  
  24.9MB
- MD5
  
  80786c7f485cdeedad5016f586b747cd
- SHA1
  
  7a8275a72b74634d9862382347915aac251057a1
- SHA256
  
  6b9af6498afcc0035482ae73ee8b18d007d83050b621758b689e8d0d9396e7f5
- SHA512
  
  89847c6c07361dff68e435e8208f1c6ddedefe1ccefce48e11510f10e2f30849492b9b0b983b0945fdcd94d260565bfb238b0f58979380602c52fb2751a6be27
- SSDEEP
  
  786432:Cpjdtg5O9/MeKI/C6x77eS9LWIMBgk1m1e8A16Wo6N:R89jC6V7ewLzk1X8lW9
Score

10^/10

agenttesla evasion execution keylogger persistence pyinstaller spyware stealer trojan upx privilege_escalation
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies security service
  evasion
- AgentTesla payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2