agenttesla

General

Target

307753755c4d0a788f18b5c5875dab5dbf30d6b00523359188603f9df3167b70
Size

702KB
Sample

220521-n93yjaaahm
MD5

1118e83a5b4e5b67eb6cf57da7102eb0
SHA1

1833e10d0f929c639498891ad7c574a66a84ebfd
SHA256

307753755c4d0a788f18b5c5875dab5dbf30d6b00523359188603f9df3167b70
SHA512

729a69c8b44993eadd6f0be0a4b12bbac5cd068ce159028000d186adc262122c3a728d9f322b92f9f54fdf363c6bf7632644891c12c0eda1bea5e00312a6a049

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.flockmail.com
Port:
587
Username:
info@jar2law.online
Password:
Kclove9090@

Targets

- Target
  
  Payment Confirmation#114_pdf.exe
- Size
  
  868KB
- MD5
  
  322bd0b3a24031f8f3c7388aa154dbbf
- SHA1
  
  06752e5047de02cc97e35f6485541303290399d9
- SHA256
  
  15a11534302310724a8a51e3d3462984bb4514609c9089ff1fbe6a5b404d7d3b
- SHA512
  
  b8719e976093ab658207bac7ce44bb485a4c84b91ae6006a3fc6a0a393fdf6abe25b681e2962217ecbe23efb261658259103f162c5cee5a675a12192a5d69b44
Score

10^/10

agenttesla agilenet collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Payment Confirmation#114_pdf/Payment Confirmation#114_pdf.exe
- Size
  
  868KB
- MD5
  
  2ee1b13c5fda8793a1e49f301dbbc0d2
- SHA1
  
  14e6c23aadeaaadcd730d1fa360f0e27940f0184
- SHA256
  
  3bfaa6286d8fbef05f151d5187b10b0d1db59112e36da9240e240c28a143b624
- SHA512
  
  493d0b189220b7a1f1b1b5e828ef809c39f0436f45ee6bd5ae5e318b130c5881264ab1c12f3292af7ecdcb11ce10a1183be69541a2592fcfe8183c6b22693a75
Score

10^/10

agenttesla agilenet collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  
  Payment Confirmation#114_pdf/pic.png
- Size
  
  194KB
- MD5
  
  c993ae50a1e06712e16aebbaf6ce80a7
- SHA1
  
  f2eafd38dc6430a7fa99b23acd1f2b532f76ec35
- SHA256
  
  3a98f5c0e7b47b1412c92b94de06c4a090165c5bfd726049a12b6a4c7379ab9a
- SHA512
  
  dfa8b341c034e577f0df0b7a270d42d3cf141036f238eed5e8e82211250a92595e456c6fcb8894cdfe62d069aee72cdaf166c14034d684f732228118358c5e1a
Score

3^/10
behavioral5 behavioral6