agenttesla

General

Target

4f85e9a778ee5bcbb0b11144a0d507eea90fc38f60c4b9b1972bf46287d2076f
Size

388KB
Sample

220521-b15pjsfhdq
MD5

25c60f5548d5dd9f3b03056dd34c6c29
SHA1

601b32026246f6a49eeb7a75426bf2784cbe2f39
SHA256

4f85e9a778ee5bcbb0b11144a0d507eea90fc38f60c4b9b1972bf46287d2076f
SHA512

dc863af6b1ad40480796cb9cb040d719a8bfbe9ff43f9a58da5b176ddc38e6c82fa394bef1c3f8c0860ecc8a493e417985054ee75bcc05376666bbb36e41749d

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yueqnugroup.com
Port:
587
Username:
[email protected]
Password:
zLE!VGv8

Targets

- Target
  
  0wqm6DEuBEtkW6x.exe
- Size
  
  470KB
- MD5
  
  8139b50c41d69f9154d6823b3451c113
- SHA1
  
  9268206861db25c60e2437e1ef8c7b8455c3e09c
- SHA256
  
  bf0d59028ae38ed30ac853eef4e6ceb21777730a1272587fd4d000e6b8b97a8e
- SHA512
  
  126771597711ad3fdff6a86f4f1c6f49e11327d15f19a018f12ffe7b5c1a8d88da06202170b26a1ded0e752825e0ff44ff966c37eae9857740fb0b02f390d2d1
Score

10^/10

agenttesla collection coreentity keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CoreEntity .NET Packer

AgentTesla Payload

ReZer0 packer

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2