agenttesla

Sharing

Copy URL

Twitter E-mail

General

Target

Xworm-V5.6.rar
Size

124.3MB
Sample

240721-vqrvgswbrh
MD5

e9f730d0562d286333d66e2557adbfcb
SHA1

9abe1fa95363231139beaa58b29a54b80a4465a2
SHA256

685b97041f1aa3e082b9816c798c7b9adeceb630ca63634035cf4fc4cbcc4cab
SHA512

ac9bdd9ac60dae37e088cda6d26c8b5a1688c8efa4b3869858c5d8b422a83a8ef3bdd95a41ac3ad593739105e5a12fffcd38d3ac57833fa7515c62c003e54491
SSDEEP

3145728:lqbnXls0EBbp/OifpPo+Pu3qqEBdTZNSpWuR6VR/BU+/1NEZju:o71s0iZ1oqtBdmWlBB/1NE8

Score

10^/10

Malware Config

Extracted

Family

xworm

127.0.0.1:43101

Attributes

Install_directory
%Public%
install_file
BSOD.exe

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

0caEF7F8CykudCG4

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Targets

- Target
  
  Xworm-V5.6/FastColoredTextBox.dll
- Size
  
  333KB
- MD5
  
  b746707265772b362c0ba18d8d630061
- SHA1
  
  4b185e5f68c00bef441adb737d0955646d4e569a
- SHA256
  
  3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- SHA512
  
  fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP
  
  6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
Score

1^/10
behavioral1
- Target
  
  Xworm-V5.6/Fixer.bat
- Size
  
  122B
- MD5
  
  2dabc46ce85aaff29f22cd74ec074f86
- SHA1
  
  208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA256
  
  a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- SHA512
  
  6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
Score

1^/10
behavioral2
- Target
  
  Xworm-V5.6/GMap.NET.Core.dll
- Size
  
  2.9MB
- MD5
  
  819352ea9e832d24fc4cebb2757a462b
- SHA1
  
  aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA256
  
  58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- SHA512
  
  6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP
  
  49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
Score

1^/10
behavioral3
- Target
  
  Xworm-V5.6/GMap.NET.WindowsForms.dll
- Size
  
  147KB
- MD5
  
  32a8742009ffdfd68b46fe8fd4794386
- SHA1
  
  de18190d77ae094b03d357abfa4a465058cd54e3
- SHA256
  
  741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- SHA512
  
  22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP
  
  3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
Score

1^/10
behavioral4
- Target
  
  Xworm-V5.6/Guna.UI2.dll
- Size
  
  1.9MB
- MD5
  
  bcc0fe2b28edd2da651388f84599059b
- SHA1
  
  44d7756708aafa08730ca9dbdc01091790940a4f
- SHA256
  
  c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- SHA512
  
  3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP
  
  24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
Score

1^/10
behavioral5
- Target
  
  Xworm-V5.6/IconExtractor.dll
- Size
  
  10KB
- MD5
  
  640d8ffa779c6dd5252a262e440c66c0
- SHA1
  
  3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA256
  
  440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- SHA512
  
  e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP
  
  192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
Score

1^/10
behavioral6
- Target
  
  Xworm-V5.6/Plugins/Informations.dll
- Size
  
  22KB
- MD5
  
  67a884eeb9bd025a1ef69c8964b6d86f
- SHA1
  
  97e00d3687703b1d7cc0939e45f8232016d009d9
- SHA256
  
  cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b
- SHA512
  
  52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7
- SSDEEP
  
  384:SCUEeL4D574MvGjydqXwxDJop0n3TmyxhxJNgSg4PbOFsK:SCXeL4DSjydqXwx1FjfNfwr
Score

1^/10
behavioral7
- Target
  
  Xworm-V5.6/Plugins/Keylogger.dll
- Size
  
  17KB
- MD5
  
  246f7916c4f21e98f22cb86587acb334
- SHA1
  
  b898523ed4db6612c79aad49fbd74f71ecdbd461
- SHA256
  
  acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a
- SHA512
  
  1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d
- SSDEEP
  
  192:rJV/HNfwK5RSpyv3RIw9RtO1Lnq4Ur1XneDN6IW1Y6Uph1KzaA0UbnnSLWqV:fFl5Rp3RntMO4U5uD8Upml0yhqV
Score

1^/10
behavioral8
- Target
  
  Xworm-V5.6/Plugins/Maps.dll
- Size
  
  15KB
- MD5
  
  806c3802bfd7a97db07c99a5c2918198
- SHA1
  
  088393a9d96f0491e3e1cf6589f612aa5e1df5f8
- SHA256
  
  34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6
- SHA512
  
  ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c
- SSDEEP
  
  192:E0XOBqmqKYNg/ymxa07XW5U6chariK8GtnNK7gGteb1/C9T6IW14X/bmjIAd2vLV:mBqmqunYL6thaujK4jtepa9BX/bY1h2
Score

1^/10
behavioral9
- Target
  
  Xworm-V5.6/Plugins/MessageBox.dll
- Size
  
  14KB
- MD5
  
  7db8b7e15194fa60ffed768b6cf948c2
- SHA1
  
  3de1b56cc550411c58cd1ad7ba845f3269559b5c
- SHA256
  
  bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29
- SHA512
  
  e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1
- SSDEEP
  
  384:56lIcAn3tURnUKCvUUVT/95gG3UX/NZSQW9:56lIL3tUSvbVa/NZG
Score

1^/10
behavioral10
- Target
  
  Xworm-V5.6/Plugins/Microphone.dll
- Size
  
  540KB
- MD5
  
  9c3d90ccf5d47f6eef83542bd08d5aeb
- SHA1
  
  0c0aa80c3411f98e8db7a165e39484e8dae424c7
- SHA256
  
  612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c
- SHA512
  
  0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe
- SSDEEP
  
  12288:+0OeMv3MrIb8CkZKobg3Wi1bRuSvazv+Uro:ROe+WIb8CkZLbg3Wa8Waz2j
Score

1^/10
behavioral11
- Target
  
  Xworm-V5.6/Plugins/Ngrok-Installer.dll
- Size
  
  400KB
- MD5
  
  3e19341a940638536b4a7891d5b2b777
- SHA1
  
  ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5
- SHA256
  
  b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa
- SHA512
  
  06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2
- SSDEEP
  
  12288:Ws6T2x75lFR/RG+BUKPqnwoCMYKIUTJE:WEB+4+1C0IU
Score

1^/10
behavioral12
- Target
  
  Xworm-V5.6/Plugins/Options.dll
- Size
  
  30KB
- MD5
  
  97193fc4c016c228ae0535772a01051d
- SHA1
  
  f2f6d56d468329b1e9a91a3503376e4a6a4d5541
- SHA256
  
  5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
- SHA512
  
  9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2
- SSDEEP
  
  768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9
Score

1^/10
behavioral13
- Target
  
  Xworm-V5.6/Plugins/Pastime.dll
- Size
  
  17KB
- MD5
  
  6430ab4458a703fb97be77d6bea74f5b
- SHA1
  
  59786b619243d4e00d82b0a3b7e9deb6c71b283c
- SHA256
  
  a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1
- SHA512
  
  7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc
- SSDEEP
  
  384:WK9Y5jI8MYODPqeivepi5zOY7//fNCsA8/h5U:WK9YNI8MVDZiWwr/TA8/hC
Score

1^/10
behavioral14
- Target
  
  Xworm-V5.6/Plugins/Performance.dll
- Size
  
  16KB
- MD5
  
  1841c479da7efd24521579053efcf440
- SHA1
  
  0aacfd06c7223b988584a381cb10d6c3f462fc6a
- SHA256
  
  043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735
- SHA512
  
  3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487
- SSDEEP
  
  384:LtpW2/E3mawGD1XTgOw2QxHN7yVppy6+:JY2ImYRDKHxV
Score

1^/10
behavioral15
- Target
  
  Xworm-V5.6/RES/XWorm.Resources.resources
- Size
  
  1.6MB
- MD5
  
  34986e38b463873af40f694874c1f6d3
- SHA1
  
  8fa89cdb7a394cf8093d548ca9db4652c703ee72
- SHA256
  
  557058bd29a5eb55ef073ea9c4dec0baea1fd3f3f4bf2cdd5ee3dfd33735e93a
- SHA512
  
  c1b0278e8c21e5c28204f692a5cf5ed16c8ada0c6022d7d38e70905255f3aeb5d2c0fd4549f0ed19ead52aa0ced891a8f9372123bf5e1710be004958750874e4
- SSDEEP
  
  49152:OsP2WTJcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHXH:zuWTGLP9Pk6gAK6n4ldyNh3
Score

1^/10
behavioral16
- Target
  
  Xworm-V5.6/SimpleObfuscator.dll
- Size
  
  1.4MB
- MD5
  
  9043d712208178c33ba8e942834ce457
- SHA1
  
  e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA256
  
  b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- SHA512
  
  dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP
  
  24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
Score

1^/10
behavioral17
- Target
  
  Xworm-V5.6/Xworm 5.6.exe
- Size
  
  31.5MB
- MD5
  
  034f44acd00471fc4a78f212c40c0fe0
- SHA1
  
  a59dfec703be202f3981a2de64f7674baf030648
- SHA256
  
  f4b8369ca881ac2fc254a79bc8b42dbed81019ac2a518b40eb2b6cd8e22cf30f
- SHA512
  
  37d6ffb0c6a2de1261f269e61bfc0905d4f49c68a34535d70b677dd660d6845e82eae5bed167e52c52f5c9b04e4d281b9693cb8b62c7311d2ac1cfddb00c81be
- SSDEEP
  
  393216:vuyIhhkRka4i8EkZQVBl86ODlHTE9Nj+CEDJKRW3I1KpnP2elMOdN6:2yshkqNhQVj86OpgeCEDJKRWPpB4
Score

10^/10

agenttesla umbral xworm evasion execution keylogger persistence pyinstaller rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Umbral payload
- Detect Xworm Payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- AgentTesla payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral18