agenttesla

General

Target

0488d3966041b187b5d62264bec104c0e4e066be4facd1ae0d36af93f4eef6ed
Size

457KB
Sample

220521-d4yfraggh7
MD5

90f65e8a91c818ea5968e29718d29f28
SHA1

1a2e1ba50d27fd30f68b41359b8eb0bbda30cc2b
SHA256

0488d3966041b187b5d62264bec104c0e4e066be4facd1ae0d36af93f4eef6ed
SHA512

4e0752166d68054633ee563946ac6fcd1c1b131e9fcb193a69f91273974096d9ca61e2a884090cfd84d815b9b0ea2ae9af051c4943533dffa6db5b19c64a662d

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.karmachalets.co.in
Port:
587
Username:
akshya@karmachalets.co.in
Password:
Akshya@123

Extracted

Credentials

Protocol: smtp
Host:
mail.karmachalets.co.in
Port:
587
Username:
akshya@karmachalets.co.in
Password:
Akshya@123

Targets

- Target
  
  Arrival_Notice00011004pdf.exe
- Size
  
  549KB
- MD5
  
  d519245ca87707045f65b3194dbf112e
- SHA1
  
  c164d290dbdeec322577695ee9e9ae263ea32a0d
- SHA256
  
  b93b2e06a2a845fe91bb512887e32848cade8cf97741f7e3f440405b388ef9ad
- SHA512
  
  ed91dabb8a308cbd7f31ff0142c3039da67c6b3e0be809ba5a6f6c6b08003d09d1476f7a162749c3ca62d9388bcc1f172c3dd9df2f5fbd2ee60b7fb1785d7fd4
Score

10^/10

agenttesla collection coreentity keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2