agenttesla

General

Target

SKM__20212210RFQ00100490100.z
Size

429KB
Sample

211023-klzdnadbfq
MD5

c0bcfce6f1bcd8984bdb03be9ce37b15
SHA1

05e823989c95341d62aac4ac3c92be39ca355298
SHA256

7478b126264a74152e2a51946f7b86b65c5ee801ebd6f9efff0f22043f529adb
SHA512

48fbc11c5d9bbe5d4fa6d12905f2904e9f0b2517c3e7f7a8758c6daaf8e32efc4799d0477a200f62c1df4feeaa439e5dc59c054521a725bd0730bdbde0ffc4b1

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

cigdem5.duckdns.org:6606

cigdem5.duckdns.org:7707

cigdem5.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vivaldi.net
Port:
587
Username:
instigator@vivaldi.net
Password:
Davidchukwuka2016

Targets

- Target
  
  SKM__20212210RFQ00100490100.exe
- Size
  
  714KB
- MD5
  
  937c3eeb4afc46f15972f8631f098fec
- SHA1
  
  b4f162eaca7ea8cca9f0e637ea81a4eb349fef1e
- SHA256
  
  b1b14fd02510b79ea7f4a9a767d3738fc9761ce0b5d8b0ca969912d7942e8a94
- SHA512
  
  07c0802c6a6e96b3a001ef5144f80260c1d17e8197fca77baadb52c1f3ec62e88d95ab72ba15a2edc70482c0df5c7f8985130ba64c3d98ec778f475da7bf3f63
Score

10^/10

agenttesla asyncrat default collection evasion keylogger persistence rat spyware stealer suricata trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
  suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
  suricata
- AgentTesla Payload
- Async RAT payload
  rat
- Nirsoft
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2