agenttesla

General

Target

b77b6eb8155754d968ac6ed131147679a09b44767e695fdf96fb5b2bf4544c9b
Size

568KB
Sample

220521-cp6yxaecf4
MD5

8bd0d81c4118fca8384af012a40b294e
SHA1

1ea94ff792d5e6a43650e43ec2a05625b48e40c5
SHA256

b77b6eb8155754d968ac6ed131147679a09b44767e695fdf96fb5b2bf4544c9b
SHA512

b2fda67440ee369421cef023dfba452802f5a816668fa14a77b878cc4ffc2d25868d2b79a2c162774c795944e144c6d872fe61770e46148d6c5fd9049cb0e308

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.khokhwmeshmesh.com
Port:
587
Username:
[email protected]
Password:
hr@kmc1800066

Targets

- Target
  
  EmiratesNBD_swift_mt103.com
- Size
  
  506KB
- MD5
  
  632cf515035dd389d366d9c11cd4f010
- SHA1
  
  141a9518344e636f71ba8b0ae68d0cb57aa57ed6
- SHA256
  
  2acce03be9204acbcc6fc59fa5bebc3720d91a9d7daa122c0ea086c4727fafce
- SHA512
  
  a2c4d74eda8af3b4bd16ba91c64c338cf266bed3dcd51dc0a87935ec2934933a0097cbf4587a467db7855d4f0e1e68989695de7a861936b443458f9943fa2c7f
Score

10^/10

agenttesla collection coreentity evasion keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2