agenttesla

General

Target

3e1e4ecca02c8d67aff2b533a32f55313e531662442494d171658decbbef00e7
Size

493KB
Sample

220521-pcby8afac8
MD5

cc9a991bbc49b9f290c5a3d4b1bed935
SHA1

8195f6d6b3b0c4e120ef81f1b3ec25ce5f3ab366
SHA256

3e1e4ecca02c8d67aff2b533a32f55313e531662442494d171658decbbef00e7
SHA512

013a86f490dd985d80c3226ced5c47a9926e081295adb56fa6fd5f47d95d902592d273e854e45ec506367126a1518791b71be91c1459b4963bc20de6911742d0

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.samudrapanel.com
Port:
587
Username:
sce.info@samudrapanel.com
Password:
weslali234

Targets

- Target
  
  NEW ORDER.exe
- Size
  
  527KB
- MD5
  
  b415aa98baabe5c84ff42584863d2d12
- SHA1
  
  acac82b099633e0410a4455caad7b5deefdd5a6a
- SHA256
  
  e15522c5644ab29fbf7093539560bf2f43d72d6e702159eb0e656c30154cfe42
- SHA512
  
  55572190b3264f9759bfd6c20f5341d02cd4a0768b65f3705393546f13100335be7b4cd1f8488c8e090478f6b56d48e936666f617749791e4b04fea4d0971851
Score

10^/10

agenttesla collection coreentity evasion keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2