agenttesla

Resubmissions

27/11/2025, 19:28

251127-x661fscn3s10

25/11/2025, 23:52

25/11/2025, 23:40

03/10/2025, 23:40

03/10/2025, 23:17

Sharing

Copy URL Twitter E-mail

General

Target
2to1ep.exe
Size 13.1MB
Sample251125-3pcceatnfl
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

xworm

Version

151.243.218.164:7007
:2017
B1OqOBScfnQ4Gk4c60H4Zw==:10

Mutex

U9QUEjE9dAiY1T1D

Attributes

Install_directory
%AppData%
install_file
OneDrive.Sync.Service.exe

aes.plain

Extracted

Family

vidar

Version

16.8

Botnet

dc8956190bdf7bad0ad073293a2161c0

Extracted

Family

fuery

http://let.mebeyourfriend.digital/
http://if.youwannabemylover.life/
http://make.mydaymakemyday.info/
http://iahfi.visbxskagt.com/
http://laf.oahgsfwklg.top/
http://smachrie1.weinerbuyout.top/
http://sackless2.backspacersasine.sbs/
http://recondole3.compositesclosetful.xyz/
http://dietaries4.permeatedicelanders.today/
http://epanadiplosis5.misdateswampanoag.cyou/
http://invoke6.escrimesesquipedal.digital/
http://bordrage7.kafkaesquebozo.info/
http://stacher8.disequilibrationaproctous.top/
http://scoliidae9.

Extracted

Family

stealc

Botnet

LogsDillerCloud

http://proproproaaa.fun

Attributes

url_path
/f65c5408012c421b.php

rc4.plain

Extracted

Family

agenttesla

https://api.telegram.org/bot7632193240:AAF8666JYzsBZl74jbf9VqmJkv7rRn8Mrwc/

Extracted

Family

xenorat

172.245.27.131

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
port
6000
startup_name
nothingset

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

172.245.27.131:6000

Mutex

7yQ13dQovyNKiXuS

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  2to1ep.exe
- Size 13.1MB
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
- MD5 7d1a85e807ff9b48edc2e08a01b35e07
- SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
- SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
- SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

dc8956190bdf7bad0ad073293a2161c0 logsdillercloud defense_evasion execution donutloader fuery stealc vidar xworm impact installer loader persistence privilege_escalation pyinstaller ransomware rat stealer trojan upx discovery agenttesla xenorat keylogger spyware themida
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Detect XenoRat Payload
- Detect Xworm Payload
- Detects DonutLoader
  loader
- Detects Vidar Stealer
  stealer
- DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Donutloader family
  donutloader
- Fuery
  Fuery is a trojan written in Delphi.
  trojan fuery
- Fuery family
  fuery
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Stealc family
  stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar family
  vidar
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
- Xenorat family
  xenorat
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2