agenttesla

General

Target

06146002319e655ea5e677ffada926dce41e36c667cf17c3604069c87cf68420
Size

983KB
Sample

220520-299mzabdhn
MD5

1c05b64dedbc100c5e8cc503ee0e7de3
SHA1

f053fa9837969c028106b1bddb4be50b64821846
SHA256

06146002319e655ea5e677ffada926dce41e36c667cf17c3604069c87cf68420
SHA512

db9d52f6e91a2be68557ef0e80c3ce04cfcbcb4df6586ca27eb2bf8a1e21ec9439b2c87c004167b82ab1f8e6ae8063766d9efd490a3c3c849c2ef1d5a11b958a

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
z123456789ok

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
z123456789ok

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=19Rww40gJ2bgnR4d0kxNPAXOhspVmcojz

xor.base64

Targets

- Target
  
  Invoices.scr
- Size
  
  642KB
- MD5
  
  7e1276e8a9605cceaeb2c92ee2dee098
- SHA1
  
  d2ff633768b6745d8e8f171d84c3aba4c2f1b92d
- SHA256
  
  e61b98aab63f89f2c11d138da7c42c20e5f5019a6063e4af547c7f2903cd133c
- SHA512
  
  ec534ea78f14507e2984e5a80a5d8cdeddfb99f96dd7c85f5ce3ad5269455fd1919cf60a922fc42610c716461ac46b8edaf364c0aa66d061305f26902fe46901
Score

10^/10

agenttesla collection evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Payment Copy.scr
- Size
  
  84KB
- MD5
  
  674e26f5f53caab5bc5b0b12ac1bb03c
- SHA1
  
  892cb32ece7918576e1bdd2c3ee638f9b2d6a751
- SHA256
  
  29bf107e81548227b24b99a950628a53b7645e674602861fa7410773464b88b1
- SHA512
  
  5f51ee306b2d970a74893fc07d17c7a40b8d18d3665bfd49f76113b0a28e253274108dd1c8bb2462ac8aa1dedf5f41ee0834f947d3e100649fd5f2bd6d82a8c8
Score

10^/10

guloader downloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
behavioral3 behavioral4
- Target
  
  Pictures.scr
- Size
  
  614KB
- MD5
  
  0548042de08d966daf12706ecef02860
- SHA1
  
  2551f1cf8b224368ebbfaa02e39ad360c9693658
- SHA256
  
  1e7474f09fbb2601bdc6f5e77ec90a9db99115e8392ba1629349f9b59f54d272
- SHA512
  
  e0c1f998eb363454bd11dae8376b77ed373004078f61e0f8bf81baae01a5d08608290ead31236506aceacba60fa51456c49ac702bceea93f2cf14edd73931fb7
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral5 behavioral6