agenttesla: accd2ccd — AutoItSC-delivered AgentTesla with SMTP C2 and browser-credential harvest

Executive Summary: AutoItSC v3.3.8.1 single-file PE32 compiled Oct 2024. Drops proximobuccal (243 KB XOR-encrypted .NET PE) and surmount (28 KB Caesar-3/hex-obfuscated shellcode) to %TEMP%. Shellcode decrypts and reflectively loads the .NET payload, which is confirmed AgentTesla with SMTP exfil to mail.myhydropowered.com, browser credential theft across 10+ browsers, clipboard/keylogger/screen capture, and WMI-based anti-VM. Static-only; CAPE skipped.

What It Is

• File: PO-22012025-RFQ.exe — procurement/RFQ lure ^[file.txt]
• Build: PE32 x86 GUI, MSVC 14.16 linker, compiled Thu Oct 24 01:06:14 2024 UTC ^[rabin2-info.txt], unsigned, empty VS_VERSIONINFO ^[pefile.txt]
• Framework: AutoItSC v3.3.8.1 single-file compiled PE32; AU3!EA06 header in .rsrc SCRIPT resource ^[strings.txt:1340]
• Cluster: Twenty-fourth confirmed sibling of unclassified-autoit-compiled; identical build fingerprint to aa4d237c (Aug 2024) — same AutoItSC runtime, same Caesar-cipher string obfuscation pattern, same dual-file drop + shellcode + reflective .NET loading chain. ^[/intel/analyses/aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8.html]

How It Works

Stage 1 — AutoIt bootstrap

The compiled script (200,424 bytes RT_RCDATA resource) decrypts at runtime via the AutoIt interpreter. ^[script.au3:1-2]

1. FileInstall("proximobuccal", @TempDir & "\proximobuccal", 1) — drops encrypted .NET payload.
2. FileInstall("surmount", @TempDir & "\surmount", 1) — drops encrypted shellcode loader.

Stage 2 — Shellcode decryption & execution

Lines 3–16 of script.au3 decode API names with L300CM2V($string, $shift) — a Caesar-cipher decoder (shift 4 for kernel32.dll calls, shift 3 for VirtualAlloc). ^[script.au3:5074]

• Opens surmount via CreateFileW with GENERIC_READ.
• Reads contents into a char[] DllStruct, closes handle. ^[script.au3:3-9]
• Decrypts buffer with L300CM2V($buffer, 3) (Caesar-3). ^[script.au3:11]
• Allocates RWX memory (VirtualAlloc, 0x3000 | 0x40). ^[script.au3:12]
• Copies decrypted shellcode into buffer. ^[script.au3:14-15]
• Transfers execution via DllCallAddress at offset +0x23b0 (9136 decimal). ^[script.au3:16]

The surmount file is Caesar-3 shifted ASCII-hex (e.g. 0x558bec...). After subtract-3 and hex-decode, it yields a 14,336-byte x86 position-independent shellcode. ^[r2:fcn.000023b0]

Stage 3 — Reflective .NET loading

The shellcode entry at fcn.000023b0 constructs the filename "proximobuccal" byte-by-byte on the stack (mild anti-static measure). ^[r2:fcn.000023b0] It then:

1. Opens proximobuccal from %TEMP%.
2. Reads file into an RWX-allocated buffer.
3. Calls fcn.000022e0 — a rolling-XOR decryption loop using a 10-byte key derived from the first 10 bytes of the file (0FDJZIIASG). ^[r2:fcn.000022e0]
4. Calls fcn.000012a0 — a manual PE mapper that parses DOS/NT headers, copies sections, resolves imports via IAT walking, processes relocations, and spawns the payload. ^[r2:fcn.000012a0]

The decrypted proximobuccal is a 243,200-byte .NET Framework 4.0 PE32 with Mono assembly metadata. ^[file /tmp/accd2ccd_proximobuccal_decrypted.bin]

Stage 4 — AgentTesla payload

The .NET assembly is AgentTesla (confirmed by class names, string artefacts, and C2 behaviour). Key indicators:

• SMTP C2: mail.myhydropowered.com, sender versace@myhydropowered.com, password 0TFiRgPxmCJcdSB; backup sender buyfromarman@myhydropowered.com. ^[proximobuccal_decrypted.bin:strings]
• IP geolocation: https://api.ipify.org and http://ip-api.com/line/?fields=hosting (hosting/VPS detection). ^[proximobuccal_decrypted.bin:strings]
• Browser credential theft: Chrome, Edge, Firefox, Opera, Brave, UC Browser, Torch, Flock, Falkon, QQ Browser, Mozilla icecat — targets Login Data, Cookies, key4.db, logins.json, signons.sqlite. ^[proximobuccal_decrypted.bin:strings]
• Email client theft: Outlook (Office 11–16 profiles), Thunderbird, FoxMail, Opera Mail, Mailbird, The Bat!, Eudora. ^[proximobuccal_decrypted.bin:strings]
• FTP client theft: FileZilla, CoreFTP, SmartFTP, WS_FTP, FTPGetter, FTP Navigator, FTP Commander. ^[proximobuccal_decrypted.bin:strings]
• VPN client theft: OpenVPN, NordVPN. ^[proximobuccal_decrypted.bin:strings]
• Discord token theft: targets discord.com, discordcanary, discordptb. ^[proximobuccal_decrypted.bin:strings]
• Clipboard monitoring: Clipboard, SetClipboardViewer, ChangeClipboardChain, EnableClipboardLogger. ^[proximobuccal_decrypted.bin:strings]
• Keylogging: EnableKeylogger, _keyLogger, KeylogText, KeyloggerInterval. ^[proximobuccal_decrypted.bin:strings]
• Screenshot capture: EnableScreenLogger, _screenLogger, ScreenInterval, CopyFromScreen, get_PrimaryScreen. ^[proximobuccal_decrypted.bin:strings]
• Anti-VM: WMI queries SELECT * FROM Win32_ComputerSystem (Manufacturer, Model) and SELECT * FROM Win32_VideoController (Name) checking for VMware, VirtualBox, VIRTUAL, microsoft corporation. ^[proximobuccal_decrypted.bin:strings]
• Mutex: hardcoded UUID a46faaf8-7e9f-41aa-82ef-2d5f29a4d725 for single-instance gating. ^[proximobuccal_decrypted.bin:strings]
• Dropped process name: DtcHF.exe (inner payload renames itself). ^[proximobuccal_decrypted.bin:strings]

No registry persistence (HKCU\Run, HKLM\Run) or scheduled-task persistence was recovered from the decrypted payload. Persistence may be achieved via the initial AutoIt execution chain (e.g. the lure document's delivery mechanism) rather than the payload itself.

Build / RE

Deploy / ATT&CK

C2 Infrastructure

• SMTP server: mail.myhydropowered.com (port not recovered statically; standard AgentTesla uses 587 with STARTTLS or 465 with SSL)
• SMTP account: versace@myhydropowered.com / 0TFiRgPxmCJcdSB
• Backup SMTP account: buyfromarman@myhydropowered.com (password not recovered statically)
• IP geolocation: https://api.ipify.org
• Hosting detection: http://ip-api.com/line/?fields=hosting
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 ^[proximobuccal_decrypted.bin:strings]

Interesting Tidbits

• Twenty-fourth sibling: This sample extends the unclassified-autoit-compiled cluster from 23 to 24 confirmed siblings. The build fingerprint (AutoItSC v3.3.8.1, MSVC 14.16, empty VS_VERSIONINFO, Caesar-cipher API obfuscation, dual-file drop to %TEMP%, shellcode entry at +0x23b0) is byte-for-byte identical to aa4d237c except for the payload family (AgentTesla vs. unclassified reflectively-loaded PE) and the obfuscation key string names (proximobuccal/surmount vs. endochylous/contrapose). ^[/intel/analyses/aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8.html]
• XOR key derivation: The shellcode derives its 10-byte XOR key from the first 10 bytes of the encrypted file (0FDJZIIASG), not from a hardcoded string in the shellcode itself — a mild anti-static measure that ties decryption to the specific drop file. ^[r2:fcn.000022e0]
• Filename lure: PO-22012025-RFQ.exe masquerades as a purchase-order / request-for-quotation document with a future-dated PO number (Jan 2025), a common social-engineering tactic in procurement-themed phishing.
• No persistence in payload: Unlike many AgentTesla variants that write to HKCU\Software\Microsoft\Windows\CurrentVersion\Run, this decrypted payload shows no registry persistence strings. The delivery mechanism (phishing email + user execution) may be considered sufficient by the operator.
• UUID mutex: The hardcoded mutex UUID a46faaf8-7e9f-41aa-82ef-2d5f29a4d725 is consistent across AgentTesla builds and can be used as a behavioural IoC.

How To Mess With It

• Extract the compiled script: autoit-ripper <sample> <outdir> — produces script.au3, proximobuccal, surmount.
• Decrypt surmount: subtract 3 from each ASCII byte, then hex-decode to obtain shellcode binary.
• Decrypt proximobuccal: XOR each byte with repeating 10-byte key 0FDJZIIASG (derived from file header).
• Load shellcode in x86 radare2 (r2 -b 32) at base 0x10000000 and trace fcn.000023b0 to observe PE mapping.
• Load decrypted .NET assembly in dnSpy or ILSpy to recover AgentTesla config classes (SmtpServer, SmtpSender, EnableKeylogger, etc.).

Deployable Signatures

YARA rule:

rule AutoIt_AgentTesla_DualDrop {
    meta:
        description = "AutoItSC PE dropping proximobuccal+surmount reflective loader pair delivering AgentTesla"
        family = "agenttesla"
    strings:
        $au3 = "AU3!EA06"
        $prox = "proximobuccal" nocase
        $sur = "surmount" nocase
        $func = "L300CM2V" nocase
        $smtp = "mail.myhydropowered.com" nocase
        $agent1 = "EnableKeylogger"
        $agent2 = "Clipboard"
        $agent3 = "ScreenInterval"
    condition:
        uint16(0) == 0x5A4D and
        $au3 and
        (2 of ($prox, $sur, $func) or 2 of ($smtp, $agent1, $agent2, $agent3))
}

IOC list:

• SHA-256 (outer): accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb
• SHA-256 (surmount): 68d023499754e9778b026ffbf1257878342850f630b86cdcf87f7291ba568eca
• SHA-256 (surmount shellcode): 7a596ff73a85cf57f02205ce341a6c1026407a7733b79990ad436677c8d3e2f4
• SHA-256 (proximobuccal encrypted): 6c57cb062792520646e9e90536a7a2d629509ee0a995e6908510cad04e53659d
• SHA-256 (proximobuccal decrypted): 9f61ed184fcef4f7c9b177a84be2456d4b007fd41ab4e4588a4e6fd05f506711
• Filename: PO-22012025-RFQ.exe
• Temp paths: %TEMP%\proximobuccal, %TEMP%\surmount
• SMTP C2: mail.myhydropowered.com
• SMTP account: versace@myhydropowered.com / 0TFiRgPxmCJcdSB
• Backup SMTP: buyfromarman@myhydropowered.com
• Mutex: a46faaf8-7e9f-41aa-82ef-2d5f29a4d725
• Decoy process name: DtcHF.exe
• XOR key: 0FDJZIIASG (derived from first 10 bytes of proximobuccal file)
• IP lookup: https://api.ipify.org, http://ip-api.com/line/?fields=hosting
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Behavioral fingerprint: AutoIt-compiled PE32 drops two files to %TEMP% with 14+ character pseudo-random lowercase names, opens one via CreateFileW with GENERIC_READ, allocates RWX memory via VirtualAlloc, and transfers control to an offset >9000 bytes into the decrypted buffer within 5 seconds of process start. The decrypted buffer then opens a second file in %TEMP%, XOR-decrypts it, and manually maps it as a .NET assembly.

References

• Analysis directory: raw/analyses/accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb/
• Cluster entity: unclassified-autoit-compiled
• Family entity: agenttesla
• Concept: autoit-compiled-script-dropper

Provenance

Static analysis performed on 2026-06-28. Tools: file(1), exiftool, pefile, radare2 (aaa level 3), autoit-ripper v1.2.0, Python manual decryption. CAPE dynamic analysis skipped — no Windows guest available. ^[dynamic-analysis.md]