agenttesla

General

Target

0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea
Size

381KB
Sample

220521-bygjyacff7
MD5

49348f071922b7100f4b43bc7e817059
SHA1

98f71b22d43a2fb8b04c480c8b69754e20625c1a
SHA256

0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea
SHA512

dd01024ca782ae797d16290b14a8e2f1efc6dd59cab26784a5ff0e72559fc637378907216a8fd22e688710c57841ab48d2c5f0a6260b647b9a41d56d3bcbb5b3

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.lettu.us
Port:
587
Username:
[email protected]
Password:
ilovejesus2020@

Targets

- Target
  
  myHCMK7ruWH4kYF.exe
- Size
  
  426KB
- MD5
  
  c3561e6ae15aa8f0b68309d6f20798a9
- SHA1
  
  ce3c13209c2799565c11509a5a6cc6b2d2d23699
- SHA256
  
  32a725941812a7722531f5575dd8f25d60392878b1d1d17c48797ac197981fd3
- SHA512
  
  1fb3575afcf1a745fc34926e3fc58ed06d25a7e2eb6d90e648dbe87ee826e2d80a323d89d61a61badb5acfd523953f86f7b71db20c32384aa1a695ece481fa54
Score

10^/10

agenttesla collection coreentity keylogger persistence rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2