agenttesla

General

Target

tmp/41c6f9cd-7d7d-4161-80c0-a3b961a113ba_vbc.exe
Size

350KB
Sample

211216-vtm1pscee3
MD5

033304a9a935c4d0d64769245abfe3ae
SHA1

ebe539aeb57b78a3ad8085fe61dcc5ce3bfb6fd9
SHA256

6500927c19e228cc116484a103ba594fdeadccf06159332ead8cc9b3d9da83db
SHA512

f9da9c01941b5694c46d9b8f1fb4d4710a025409b672eb62ca913979f0aa26fc1ac8eb922388c4c29c8f7405ad268a871221cd38b0494c18936612756af021c0

Score

10^/10

Malware Config

Targets

- Target
  
  tmp/41c6f9cd-7d7d-4161-80c0-a3b961a113ba_vbc.exe
- Size
  
  350KB
- MD5
  
  033304a9a935c4d0d64769245abfe3ae
- SHA1
  
  ebe539aeb57b78a3ad8085fe61dcc5ce3bfb6fd9
- SHA256
  
  6500927c19e228cc116484a103ba594fdeadccf06159332ead8cc9b3d9da83db
- SHA512
  
  f9da9c01941b5694c46d9b8f1fb4d4710a025409b672eb62ca913979f0aa26fc1ac8eb922388c4c29c8f7405ad268a871221cd38b0494c18936612756af021c0
Score

10^/10

agenttesla neshta collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- AgentTesla Payload
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2