agenttesla

General

Target

0844c77fb975dd66016a3ce678094610256dc597740a46fce219cafcf5d21435
Size

398KB
Sample

220521-d34w5sgge3
MD5

767dc5889e48e284acc9b53689c8e2ee
SHA1

bd221edff72a0a2226d971af3f2703c815573d98
SHA256

0844c77fb975dd66016a3ce678094610256dc597740a46fce219cafcf5d21435
SHA512

8b2a88a079aafc8e723927821cd9fc2b8379690d2eb4320fa5943fd087810549ef4e90a3925a5d3c80d970de7d13bd68d21500550517db6f069269e529169529

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
vps36800.inmotionhosting.com
Port:
587
Username:
server-me@exclusivecommunities-primary.com
Password:
;D^nHzqV0,Md

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
vps36800.inmotionhosting.com
Port:
587
Username:
server-me@exclusivecommunities-primary.com
Password:
;D^nHzqV0,Md

Targets

- Target
  
  PO.202315...pdf.exe
- Size
  
  453KB
- MD5
  
  7703f61f033db10e51eab07ec941b1b1
- SHA1
  
  98fd781134413d6b86c5321e86152a2a524c7e30
- SHA256
  
  d58a3fea3dec563fd6c1f2d7c159b25d7d161c2b7c298f9b0226953e3ccb4e36
- SHA512
  
  68485c0b61de7d4d5295818db4eff9e0dd13ac0511a8ef9a04f8c70c6afd34de98548b321f3264e0c7f3a833d853a9a128779962ee524acb105d9f87783af419
Score

10^/10

coreentity rezer0 agenttesla collection keylogger persistence spyware stealer suricata trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata
- AgentTesla Payload
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2