agenttesla

General

Target

ca154b299e9ab506d7280f76f529ce54e8eff1bec9c9e04bfcf5ed84bad628eb
Size

1.1MB
Sample

220521-pssa5sfhg7
MD5

6594a8defb72d0ee9cb9ec4fc5dbeff0
SHA1

8aca4446ec03cc9383bfe14068af090c6f89e256
SHA256

ca154b299e9ab506d7280f76f529ce54e8eff1bec9c9e04bfcf5ed84bad628eb
SHA512

3e71a130f698467961e48b46991d76a0994a30a18abfe3ca970c8f2a482df9b37f0d2238d0612e804ac86a902c2e5263ed8b925003e90271bc975dad06dd0b94

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
haka@haknaz.co
Password:
bloodmoneykillu

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
haka@haknaz.co
Password:
bloodmoneykillu

Targets

- Target
  
  Drawings.exe
- Size
  
  552KB
- MD5
  
  82fde7e5324aa0000306fbc62820b5d4
- SHA1
  
  3311a012c8290d3eaf851489ceb02a633bd2fdef
- SHA256
  
  52a5b10358396169aa44cb5959f68b2cdcfb9473596b2d8a8c5118066d4d9b29
- SHA512
  
  8a7ead9fc8eb951f159f4028377ec7af7956de771ef8a8519a4595bda7f5d7335a02cf9f69912c2bea28d02f33e61c7a599c31ac73a7d4731e91e6597f22cdeb
Score

10^/10

agenttesla collection evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  order#0098546.exe
- Size
  
  610KB
- MD5
  
  dc7e1356d22a3b0091a34cb40511c5d9
- SHA1
  
  85315f1c6312dfc145adc57bb00faf0d74cbe579
- SHA256
  
  641f9d7b6e453134da26e8a39cca0cb3b6860f69515ad434d4c99f26916bdc83
- SHA512
  
  2248dba50f1c978a8633eeb4c6f8d3776cd8e154a18b1cc35b4f3f7d2cad02d480e34eaa4bcf29b298154dbd48fd5be9e37ca92c266fb36f175923084023eeff
Score

10^/10

agenttesla collection evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral3 behavioral4