agenttesla

General

Target

Payment Details_ 11-03-21.jar
Size

207KB
Sample

210314-h77qq3cxxe
MD5

10c6eea1c0cfcc698b01deb033d04f83
SHA1

25815e3b45373b89d332fa42fe36a26d7d20c4db
SHA256

702d843adb5178c567c92fcb19571a7d0b8ce1f6ec08e0a82ba6eb2c37026a62
SHA512

01ae4d3dd3a475db95fb1c32e6f6737e5ca06c582179823c8313624b8532fdc7a7c23104eea01f2af70a873757b647977839373aeaf1c6b75bd413a22909584e

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://transfer.sh/get/dsN3t/word.exe

Extracted

Family

asyncrat

Version

0.5.7B

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:49703

chongmei33.publicvm.com:49746

185.165.153.116:2703

185.165.153.116:49703

185.165.153.116:49746

54.37.36.116:2703

54.37.36.116:49703

54.37.36.116:49746

185.244.30.92:2703

185.244.30.92:49703

185.244.30.92:49746

dongreg202020.duckdns.org:2703

dongreg202020.duckdns.org:49703

dongreg202020.duckdns.org:49746

178.33.222.241:2703

178.33.222.241:49703

178.33.222.241:49746

rahim321.duckdns.org:2703

rahim321.duckdns.org:49703

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
hGScKRB0VrlS4WpFo0N7AmnZQApV4qsi
anti_detection
false
autorun
false
bdos
false
delay
FEB
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
2703,49703,49746
version
0.5.7B

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
pifgweijlylkellk

Targets

- Target
  
  Payment Details_ 11-03-21.jar
- Size
  
  207KB
- MD5
  
  10c6eea1c0cfcc698b01deb033d04f83
- SHA1
  
  25815e3b45373b89d332fa42fe36a26d7d20c4db
- SHA256
  
  702d843adb5178c567c92fcb19571a7d0b8ce1f6ec08e0a82ba6eb2c37026a62
- SHA512
  
  01ae4d3dd3a475db95fb1c32e6f6737e5ca06c582179823c8313624b8532fdc7a7c23104eea01f2af70a873757b647977839373aeaf1c6b75bd413a22909584e
Score

10^/10

agenttesla asyncrat evasion keylogger macro persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- AgentTesla Payload
- Async RAT payload
  rat
- Nirsoft
- Blocklisted process makes network request
- Executes dropped EXE
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2