agenttesla

General

Target

57937794fb95166659703b275620affd15c17d2b57895c192c253befd913be2c
Size

395KB
Sample

220521-nsf3fahbfl
MD5

1de6f1e70a2450b5175851a315c6e96f
SHA1

dda5d37dd04c0baa9277c44ad21f46cb93380f56
SHA256

57937794fb95166659703b275620affd15c17d2b57895c192c253befd913be2c
SHA512

eb6760d3fbb158173e4baa70af844b1a8387c9c0f523063e53d4c15436cda9c88ed7a9d7d20f46800d17bdb5fc81ffb5780209752fffcf55f3738f2ed4dfe6e2

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.karmachalets.co.in
Port:
587
Username:
akshya@karmachalets.co.in
Password:
Akshya@123

Extracted

Credentials

Protocol: smtp
Host:
mail.karmachalets.co.in
Port:
587
Username:
akshya@karmachalets.co.in
Password:
Akshya@123

Targets

- Target
  
  AN_FSOFCL2020052211pdf.exe
- Size
  
  437KB
- MD5
  
  06e5438b6fbc0f98f8803941b82e59ce
- SHA1
  
  8bb193064d3889816adf06c208730c24bf5613aa
- SHA256
  
  672e3f987619a0968785b91fc3e8a824be6f331e9a49859519de5c143d354700
- SHA512
  
  0fba3805183faec0401f8f5fc2474ef402fa1d8b554a9fc4f08aa0270a4e47c35785c32ddaf588676b7450b266de3f2e069bcb7d4da2e2e277a1afd88b727197
Score

10^/10

agenttesla collection coreentity keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2