agenttesla

General

Target

e3403f10814893a008fe45c40ea15cc1a02ecb82b8946f27582d54d5d892ee6e
Size

464KB
Sample

220521-cd6trsggcp
MD5

a36f43b93e140239021598b5834d4d5f
SHA1

e2da905b34a249d79a952de7ac0647953eda4169
SHA256

e3403f10814893a008fe45c40ea15cc1a02ecb82b8946f27582d54d5d892ee6e
SHA512

d431b89182e395c27d2b62564a6f542b8aa61cb934f969e7eec1ee255522abaffa943fc90c5b2650fd1e8fdd1e72a6cf331057b6d5b81670a4c3d417eea9f9af

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kukken.com.tr
Port:
587
Username:
demet@kukken.com.tr
Password:
Qaz1234#demet

Extracted

Credentials

Protocol: smtp
Host:
mail.kukken.com.tr
Port:
587
Username:
demet@kukken.com.tr
Password:
Qaz1234#demet

Targets

- Target
  
  PO.BBR785600.exe
- Size
  
  498KB
- MD5
  
  24c0bcc76895ad0caf4b9788d37c5ee0
- SHA1
  
  b87af07089ca1fc7a52f0d73520ebada08cfc722
- SHA256
  
  5e570c2f5a2d7d214e8ecbe04ce55a88dac0ca339932ec54d3027804b2f37bf8
- SHA512
  
  807126ee0626e42063f3210b15671a555f0d2658e240e028c664f0b10c164287510d7879ba16d9aef084ef3433de1cb900ac07b065c4ce8f123f9bc2cd9c381e
Score

10^/10

agenttesla collection coreentity evasion keylogger rezer0 spyware stealer trojan suricata
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2