Malware Analysis — Agent Tesla (AT.exe)
Static & dynamic DFIR investigation with MITRE ATT&CK mapping
- Tuwaiq Academy — Malware Analysis
- AT.exe / Lbee.exe · 1.12 MB · Win32 GUI · .NET
- Agent Tesla — Information stealer
- 47 / 71
Overview
End-to-end reverse engineering of a suspicious Windows PE (AT.exe) submitted for analysis. Static inspection with PEiD, BinText, pestudio, and dnSpy confirmed a 32-bit .NET / WinForms binary masquerading as 'EventCore Manager Pro'. Dynamic detonation in ANY.RUN observed startup persistence, DNS beacons to mail.onionmail.org, and YARA-triggered attribution to the Agent Tesla family. VirusTotal returned 47/71 detections.
My Role
Lead analyst — hashing, static structural analysis, .NET assembly review, sandbox detonation, IOC extraction, ATT&CK mapping, and containment recommendations.
Tools & Frameworks
Sample Identification
- MD5: 73984DC6501E360231231DF9CF877F50
- SHA256: d3030deea9a49c1ae50e92acdad8799c9d082c917a419200f7b7462e13d2f67e
- Size: 1.12 MB (1,174,016 bytes)
- Type: 32-bit PE executable · GUI · .NET
- Entry-point: 0x0011EB66 · EP Section: .text
Static Analysis
PEiD and pestudio confirmed a clean PE structure with three sections (.text, .rsrc, .reloc), Microsoft .NET signature, and Win32 GUI subsystem. BinText surfaced numerous WinForms artifacts (Form10, button10, dataGridView10) and CLR strings. dnSpy resolved WindowsForms.Program.Main as the entry point and exposed imports across mscorlib, System.Windows.Forms, System.Data, System.Diagnostics, and Microsoft.VisualBasic — consistent with a fake administrative utility.
Dynamic Analysis (ANY.RUN)
Detonation produced observable persistence, external network beacons, and YARA family attribution.
- Persistence — dropped PxNnxhuo.lnk into %AppData%\Microsoft\Windows\Start Menu\Programs\Startup
- DNS — request for mail.onionmail.org
- C2 candidates — 208.95.112.1 · 73.249.33.206
- YARA — 'AGENTTESLA has been detected'
MITRE ATT&CK Mapping
- T1547.001 — Registry Run Keys / Startup Folder
- T1562 — Impair Defenses
- T1071 — Application Layer Protocol (C2)
- T1219 — Remote Access Tools
- T1552 — Credentials from stored files & browsers
Containment & Response
- Block observed C2 IPs and the mail.onionmail.org domain at the perimeter
- Hunt for the SHA256 and MD5 across the estate
- Audit Startup folders for PxNnxhuo.lnk or unfamiliar .lnk files
- Rotate credentials for any accounts stored in browsers on affected hosts
- Threat-hunt for the same IOCs across the wider environment
Outcome
Sample confirmed as a member of the Agent Tesla / Agenttesla information-stealer family. External corroboration links the same SHA256 and mail.onionmail.org domain to prior public reports. Behavioural profile — persistence, spying capability, and external C2 — is fully consistent with the family's TTPs.
Supporting File
Executive Malware Report (Arabic)
DOCX · Full technical write-up