agenttesla

General

Target

1fb7d599571f4b4ed7906c0eea2a99e9539eef2480052274c5ac9901624b6de1
Size

3.7MB
Sample

220612-vh3xsacga6
MD5

819ed37eb7743bb244d9f34c53e29ec2
SHA1

d1adbdea5d6ee7796af0901467f6953609002e2c
SHA256

1fb7d599571f4b4ed7906c0eea2a99e9539eef2480052274c5ac9901624b6de1
SHA512

1c1eca6e79961bd6b687c551d1eaf5a136225086377aa86f6dd351df1119a86e8230a3fdcedec56505e39abca47c81d4a1fa1dd14c10e0585c173e4a66cac0e1

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.barclarysbank-uk.com
Port:
587
Username:
md@barclarysbank-uk.com
Password:
KINGqqqqqq@12

Extracted

Family

limerat

Wallets

15n8aFLks2Gpcafffb4x2iXDpcLQMRwnTv

Attributes

aes_key
Only4biz11@
antivm
false
c2_url
https://pastebin.com/raw/Ej7DeJ3r
delay
3
download_payload
true
install
false
install_name
abc.exe
main_folder
Temp
pin_spread
false
sub_folder
\cvc\
usb_spread
false

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.barclarysbank-uk.com
Port:
587
Username:
cv@barclarysbank-uk.com
Password:
KINGqqqqqq@12

Mutex

0592e06f-4141-429b-b49c-07b5b11b5821

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:KINGqqqqqq@12 _EmailPort:587 _EmailSSL:true _EmailServer:mail.barclarysbank-uk.com _EmailUsername:cv@barclarysbank-uk.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:true _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:45 _MeltFile:false _Mutex:0592e06f-4141-429b-b49c-07b5b11b5821 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  1fb7d599571f4b4ed7906c0eea2a99e9539eef2480052274c5ac9901624b6de1
- Size
  
  3.7MB
- MD5
  
  819ed37eb7743bb244d9f34c53e29ec2
- SHA1
  
  d1adbdea5d6ee7796af0901467f6953609002e2c
- SHA256
  
  1fb7d599571f4b4ed7906c0eea2a99e9539eef2480052274c5ac9901624b6de1
- SHA512
  
  1c1eca6e79961bd6b687c551d1eaf5a136225086377aa86f6dd351df1119a86e8230a3fdcedec56505e39abca47c81d4a1fa1dd14c10e0585c173e4a66cac0e1
Score

10^/10

agenttesla hawkeye_reborn limerat m00nd3v_logger infostealer keylogger persistence rat spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- AgentTesla Payload
- M00nD3v Logger Payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2