agenttesla

General

Target

5a483216f6aa09005ae569c676fb4cba.exe
Size

137KB
Sample

201229-k8jd691gcn
MD5

5a483216f6aa09005ae569c676fb4cba
SHA1

9d929b5a3698b0ce8a58027d48023ca1fb8ac400
SHA256

52aeb2a84c9652b097aef1a053a4e8b4a7c48745a7e939419747a275e3ea6294
SHA512

8827104265b8cef1110ded0f38a234e8f59cbbb491645dee08179ad70ff3776b8f56e0ca720b62bdba3d168e8c28ce684ba5f078b178486e0b26588362603654

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://vtdilet.com/upload/

http://netvxi.com/upload/

http://tinnys.monster/upload/

rc4.i32

Targets

- Target
  
  5a483216f6aa09005ae569c676fb4cba.exe
- Size
  
  137KB
- MD5
  
  5a483216f6aa09005ae569c676fb4cba
- SHA1
  
  9d929b5a3698b0ce8a58027d48023ca1fb8ac400
- SHA256
  
  52aeb2a84c9652b097aef1a053a4e8b4a7c48745a7e939419747a275e3ea6294
- SHA512
  
  8827104265b8cef1110ded0f38a234e8f59cbbb491645dee08179ad70ff3776b8f56e0ca720b62bdba3d168e8c28ce684ba5f078b178486e0b26588362603654
Score

10^/10

smokeloader backdoor trojan agenttesla raccoon redline discovery infostealer keylogger spyware stealer upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- AgentTesla Payload
  keylogger stealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- JavaScript code in executable
behavioral1 behavioral2