agenttesla: 0ce2a9be — Delphi VCL native stub → raw .NET metadata overlay → AgentTesla infostealer

SHA-256: 0ce2a9bef251a42648a4ef198c4da7cb4c707b9635b13036d3d552fc87ac1566
File: 286,208 bytes, PE32 executable (GUI) Intel 80386, 8 sections
Outer framework: Borland Delphi VCL (DVCLAL / PACKAGEINFO resources, SOFTWARE\Borland\Delphi\RTL registry string)
Inner payload: .NET Framework 4.0 assembly (AgentTesla infostealer) stored as raw metadata without PE header
Confidence: High — #US and #Strings streams contain canonical AgentTesla identifiers (SmtpPassword, EnableKeylogger, Clipboard, VaultGetItem_WIN8, CopyFromScreen)

1. Build / RE

Outer stub: Borland Delphi VCL

• Compiler: Delphi 7-era VCL (confirmed by DVCLAL and PACKAGEINFO resources in .rsrc, SOFTWARE\Borland\Delphi\RTL string) ^[rabin2-info.txt]
• Sections: standard Delphi layout (CODE, DATA, BSS, .idata, .tls, .rdata, .reloc, .rsrc) ^[pefile.txt]
• Imports: kernel32.dll, user32.dll, advapi32.dll, oleaut32.dll — VCL runtime surface, no overt malicious imports ^[strings.txt:1–200]
• Timestamp: not evaluated for fabrication

Overlay: raw .NET metadata (no PE header)

• Overlay start: file offset 0xA200, size 244,736 bytes to EOF ^[pefile.txt]
• .NET metadata root: BSJB at overlay offset 0x1da08 (file offset 0x27c08); version string v4.0.30319 ^[overlay_full.bin:0x1da08]
• No MZ+PE header precedes BSJB — exhaustive scan between 0xA200 and 0x27c08 returned zero valid PE signatures. The payload is stored as raw CIL/metadata, not a nested executable.
• Streams (5):
  • #~ — compressed metadata tables, offset 0x6c relative to BSJB, size 0x6e20
  • #Strings — ASCII string heap, offset 0x6e8c, size 0x5194
  • #US — UTF-16 user-string heap, offset 0xc020, size 0x5274
  • #GUID — GUID heap, offset 0x11294, size 0x10
  • #Blob — blob heap, offset 0x112a4, size 0x23c0 ^[overlay_full.bin:0x1da28]

Loader logic (Ghidra decompile)

Entry point 0x00408178 (entry) performs the following sequence:

1. Calls FUN_00403f14 to initialise Delphi RTL / exception frame.
2. Loads string literals via FUN_004070d0 with size/count pairs (0xb, 0x9, 0x3, etc.) — these are the resource names and extension filters used later.
3. Calls FUN_004049d0(0, ...) to resolve a resource path; FUN_00404f6c (wrapper around FindFirstFileA) checks the file size. If size > 0xA200, branches to FUN_004076c8.
4. FUN_004076c8: allocates buffers, reads the overlay from the host PE, XOR-decrypts it (FUN_0040254c builds a key from local_14), writes the decrypted payload to a temporary file, and sets FILE_ATTRIBUTE_HIDDEN.
5. FUN_00407f24: enumerates resources (string matching/filtering loop) and calls FUN_00407e30 with the extracted temp path.
6. FUN_00407e30: executes the decrypted payload via WinExec(lpCmdLine, uCmdShow) — path starting with \\ triggers FUN_00407220 (temp-path handler), otherwise FUN_00407c1c (local execution). ^[ghidra:entry-00408178] ^[ghidra:FUN_004076c8] ^[ghidra:FUN_00407e30] ^[ghidra:FUN_00407f24]

Anti-analysis

• None observed in the native stub beyond standard Delphi SEH (fs:[eax] = esp). No debugger checks, no VM detection, no import table obfuscation.
• The .NET payload is not encrypted at rest beyond the XOR layer applied by the Delphi stub.

2. Deploy / ATT&CK

All TTPs below are inferred from static .NET metadata; no CAPE detonation was performed (no Windows guest available).

C2 configuration

• No live SMTP host or credentials recovered statically. The #US stream contains field names (SmtpServer, SmtpPassword, SmtpPort) but not their values. C2 config is likely stored in the #Blob heap, in an encrypted resource, or constructed at runtime.
• Placeholder IPs: 1.0.0.0 at overlay offsets 0x39944 and 0x3b800 — default/placeholder values, not live C2. ^[overlay_full.bin]

Payload structure

The inner AgentTesla is a standard .NET Framework 4.x assembly with these modules:

• System info grabber — IP, OS, CPU, RAM, MAC
• Browser credential harvester — 30+ Chromium/Firefox-based browsers + IE/Edge
• Email credential harvester — Outlook, Thunderbird, Foxmail, Mailbird, etc.
• FTP credential harvester — FileZilla, CoreFTP, WS_FTP, etc.
• VNC password harvester — TightVNC, RealVNC, TigerVNC
• Clipboard logger — SetClipboardViewer / ChangeClipboardChain
• Keylogger — user32.dll hook
• Screenshot capturer — CopyFromScreen
• Windows Vault API — vaultcli.dll for Credential Manager
• Exfil via SMTP (STARTTLS/SSL) with optional Tor tunnel

3. Attribution / Clustering

• Family: AgentTesla — high confidence based on #US/#Strings identifiers.
• Delivery cluster: This is a new delivery vector for the corpus: a Borland Delphi VCL native stub that extracts and XOR-decrypts a raw .NET metadata blob, then WinExecs it. Previously observed AgentTesla samples in this corpus used AutoItSC loaders (6718622d, b017d189, accd2ccd) or .NET Native AOT (bee6e88e).
• No cluster siblings identified — the Delphi VCL + raw .NET metadata chain is unique among the 169 indexed entities.
• Builder: AgentTesla is sold as malware-as-a-service; the Delphi stub may be a custom wrapper provided by a specific affiliate or a secondary builder layer.

4. IOCs

5. Remaining questions

1. C2 config recovery: The actual SMTP host, port, username, and password are not present in #US or #Strings. They may be in the #Blob heap, in an encrypted .NET resource (not yet parsed), or computed at runtime from a key schedule.
2. XOR key: FUN_0040254c in the Delphi stub builds a key from local_14 (4 bytes) before decrypting the overlay. Static key recovery requires deeper decompilation of the key-derivation routine.
3. Sibling hunting: Search for other Delphi VCL PEs with overlay size > 0xA200 and BSJB near overlay offset 0x1da00 to find cluster siblings.

6. References

• agenttesla — family entity
• delphi-vcl-dotnet-loader — delivery technique (this report)
• raw-dotnet-metadata-staging — concept page for headerless .NET payloads
• smtp-exfiltration — exfiltration channel
• browser-credential-harvesting — primary collection behaviour
• clipboard-hijack-cryptocurrency — related clipboard behaviour
• unclassified-autoit-compiled — prior AgentTesla delivery cluster in this corpus