agenttesla

General

Target

cf6e3f0ce8b1a59ec6505147e394a273eb55f7c987faec8824001419ac4e807e
Size

402KB
Sample

220521-cjsjbseab6
MD5

7fc89d78e0ab8903852e3bd1e97ca247
SHA1

fd7c05f6b2bf7ea4d4af855941edda80ed705f10
SHA256

cf6e3f0ce8b1a59ec6505147e394a273eb55f7c987faec8824001419ac4e807e
SHA512

86a006cdf5205e02c915ad3b6736b3c093501401d463075c74ec4a3ef413415f12ab71a0d58fcf23674f3c613248771fb9a6097a9b5913a3655e02c051d5392a

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
bambam10

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
bambam10

Targets

- Target
  
  Inquiry.exe
- Size
  
  464KB
- MD5
  
  ed7359e4b434485f01549ef3ad72a85f
- SHA1
  
  aaa4b1d3fa30d0c1ab32b4fa11139914070e29b4
- SHA256
  
  ba123e2be2891c5decb58c5f87b722e363a86679d7823bc01f93cf58f1c8973a
- SHA512
  
  64b93b5b131d17f2b5eb8d741a620420620663bc9ced3aeb6644c68c35c6c7d6d2df537693a9b9c3d0ad4afb8ee59f77a24c3f7cec608d5cb33e366f14db7788
Score

10^/10

agenttesla collection coreentity evasion keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2