agenttesla

General

Target

6cb2aac5524a46c2a394104d7b882b06f65ca95d62e39aa47f758e9708c4072c
Size

513KB
Sample

220521-pbezgsabep
MD5

6cfd53e466cea9de8d510716bcf2641f
SHA1

cffc8bc3df7471a7b72323cbf14898987093b932
SHA256

6cb2aac5524a46c2a394104d7b882b06f65ca95d62e39aa47f758e9708c4072c
SHA512

86c3f9d2cf50902763e75e00c3f9f9ee7f438f5328ef04e71c67ce8eaccc96c6b56b13da82285ccf650cff5d6b668b432d8b77a92423ae0247308d8551c4c6d2

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ereglitso.org.tr
Port:
587
Username:
[email protected]
Password:
#(G=xru&3R-8

Targets

- Target
  
  BOOKING 6x20' AGL.pdf.exe
- Size
  
  604KB
- MD5
  
  67d52644b5e58b57b81cddcd40bce613
- SHA1
  
  5c027479621a99fcc91a5cb4f1df952e5f20a47b
- SHA256
  
  62433e4de86d61a56cfc3333382d8a43d666a4839415a88ceca53a0754e06636
- SHA512
  
  3a09e502752180cb9a967cbb3095e515c0d0493c184254bdce4c76ab8fb4c2bb7667606a2f243741cd2496f90c85152d6a78eef605e3a55ae6e67f8f9c5b0c55
Score

10^/10

agenttesla collection coreentity keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2