agenttesla | fec310d94ce1dc601f6721c5b3745ad98c0b981636e75bde7140dfaab312ba17

General

Target
fec310d94ce1dc601f6721c5b3745ad98c0b981636e75bde7140dfaab312ba17
Size 154KB
Sample261102-w37bdayv9p
SHA256 fec310d94ce1dc601f6721c5b3745ad98c0b981636e75bde7140dfaab312ba17
MD5 c12f872e78550fd0401844e9c9e58621
SHA1 bfcfc810cc9921427d6dd304817be71ddb254d5f
SHA512 3ca12fe73c35f6b7b95249d121c84e8a9a67e011ea28342cfce6b6a2c235b3638fd550f7f98f16c465ee9f70136cab454c53074e6237240edff0cbefa94476cc
SSDEEP 3072:TzNGnnZg1rMoEaTIha9Y+4kb4KMfIHU/FJAorfO6wUxClcijFvXTE:PWnwr5EaTIMY5I4KmlJE6wUgfjFbE
TLSH
T1B0F31248F2DEE2AF8F59492F41A4443E337B60E06E857FDE21660A2266435DCED33391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

vallxx.duckdns.org:4689

Mutex

LZBDpGU2NGqFwoUo

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.brightlearning.com.my
Port
21
Username
[email protected]
Password
Lys@zw)GiT1qxo=k

Targets

- Target
  Factura proforma impagada.vbs
- Size 199KB
- SHA256 8bd896323c194a21e854269411af1cce7d0f240f1038af03aaf5c4ca6f94d460
- MD5 c6d5b7a4424688beac4906d051f6ccf7
- SHA1 ccaad373152ec55290e10959e1c838cb41fe9d01
- SHA512 b100538a149e4e21686426bd9cb4cd648117152bd339698cdf65ce69fbbd870e857802362035b3f49d597db441edd7b66cba2d71679f3dc359ca6e8680b829e9
- SSDEEP 6144:w/aaogrWfBm+F23kK7/Uyi5taxOH+s1Uq7SnOnPaaqmuHa:9M3TUyi5taxOH+vm2CuHa
- TLSH
  T1DE14E05B1AB029D0762F0B361CD109B452653EF61A98BCD3BFAD7122B35C2760ADC1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution agenttesla xworm keylogger rat spyware stealer trojan
- Detect Xworm Payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2