agenttesla

General

Target

New Tender.exe
Size

1.5MB
Sample

220125-rmtywsghfm
MD5

421422ea74c1f97efd4c202ab402210d
SHA1

674045a74cd3c1d54b494e3638ead5bb9d4e421e
SHA256

68c0f9e10a5529d1a3d7031f4364a7e04746db13515041c94ceecf9a706fc671
SHA512

b1b9483f05b74adcb76faf21ed4a3e90b7effa4451f7829e670d7f5597c7523693ce8317bfd5091b31e68489798875ebb999cebac876a4389cfd9b6800d37b12

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

3.2.1 Pro

Botnet

RemoteHost

C2

janeilla.myddns.me:9711

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-SLEDDG
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1841252439:AAFeBNk12wAgfxXFXtqpw50JT4iCgTc-FsM/sendDocument

Targets

- Target
  
  New Tender.exe
- Size
  
  1.5MB
- MD5
  
  421422ea74c1f97efd4c202ab402210d
- SHA1
  
  674045a74cd3c1d54b494e3638ead5bb9d4e421e
- SHA256
  
  68c0f9e10a5529d1a3d7031f4364a7e04746db13515041c94ceecf9a706fc671
- SHA512
  
  b1b9483f05b74adcb76faf21ed4a3e90b7effa4451f7829e670d7f5597c7523693ce8317bfd5091b31e68489798875ebb999cebac876a4389cfd9b6800d37b12
Score

10^/10

agenttesla remcos remotehost collection evasion keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies WinLogon for persistence
  persistence
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- AgentTesla Payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Drops file in Drivers directory
- Executes dropped EXE
- Stops running service(s)
  evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2