agenttesla | a97aebfb9e2d5401ee4ba81adf96ad67fbc09f073b50c5a2f5ceda49e3d55a48

General

Target
Nuevo pedido de mercanc�as adjuntas.uu
Size 642KB
Sample261028-s17btad17k
SHA256 a97aebfb9e2d5401ee4ba81adf96ad67fbc09f073b50c5a2f5ceda49e3d55a48
MD5 bc893a6b99ef82eb9666887f09db5b88
SHA1 3643e3c1a80cda66c78e6c08828f555dd2f27535
SHA512 f46d17ddd9108021b3cd04df88aedb3d417eccf9d78610443bd22db35f90d04cf70a3b61fad1aa4b652f49c908b1ee8e54bd8d1b501b57b9a14957fbd99bba35
SSDEEP 12288:W/FJXEcgqbj2Jkxy+OZNGdHnrbosQFpajYwi3VQ:gF1VjspZNAHXofgiFQ
TLSH
T189E42352209FF1F99D2A879056467D0EC407C2D8B2EDF2102AE3193D1A26D437D77EE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

vallxx.duckdns.org:4689

Mutex

LZBDpGU2NGqFwoUo

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.brightlearning.com.my
Port
21
Username
[email protected]
Password
,Aept[$)OmwWgF+Y

Targets

- Target
  Nuevo pedido de mercancías adjuntas.exe
- Size 767KB
- SHA256 28dcad782b408d7847f2e9bab490fbb17e3adb7a2632b0e4fe5da498bd24b77e
- MD5 fd14bea523aab2b8d21b6c7ea4a1da57
- SHA1 14afa2d1acd9f171c034ddc3e7c779b379289360
- SHA512 f4b6f7a1d2e3a7b17fd7b0263ddab67564600e441857dd37417db943bbbf69a2bfe6361f4bfb4534893f548b8d4963d5ca08cdbf952a8ad3e0e9564091c69f6e
- SSDEEP 12288:/lz3oTHGqQe1AElSVSCWHBUlGbnCvfLHnMIw0YqqLoVdN5r+BGuS3z87L6JD9WeC:BoTH+e1nSoCWH+G6zsIvZqLoHkGfz87q
- TLSH
  T177F4F12823E85B68E5BE637D5071112817F1F906C733E71D7E5A54FA0E72B82CA66323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery agenttesla xworm keylogger rat spyware stealer trojan costura execution packer pyinstaller upx
- Detect Xworm Payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2