agenttesla

General

Target

9511a30639a096cec9156a0cd3184875516a17956522108e4053bc2c76019c94
Size

438KB
Sample

220521-phvcraaegp
MD5

b7c2694702c9b0370e6a0808401755ca
SHA1

d57ecd2e9fa24369501690c4f4571a2610d823cc
SHA256

9511a30639a096cec9156a0cd3184875516a17956522108e4053bc2c76019c94
SHA512

0fd80238b00340bbe0de4c9ba3871b26866d48b504f9f885d8d37bb6005c8490bdb485922fc81ca6bac8172bb14d2c2b54c0600923778ba8da3ddf9ac39db37d

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
sales@bluerangesa.net
Password:
bluerange192

Targets

- Target
  
  UPDATED STATEMENT OF ACCOUNT.exe
- Size
  
  517KB
- MD5
  
  ea02ba05886fe6b37ce64156bb61f6f6
- SHA1
  
  032ee549892fcc1c9997a24219f9a152e32219e4
- SHA256
  
  008166254b8e5a8426887188cdf60bf1c213485d5bab7cb92fa9006835dfcb64
- SHA512
  
  1e2843f9e3536cfd197419e485b0dddd3836ef046501e6155af38f04930e84fe05a5eb0c3ff4f0150f3c20ab0236511904ab89f97e1e511f83b73ce3f4006d11
Score

10^/10

agenttesla collection coreentity keylogger persistence rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2