agenttesla

General

Target

IVPzpgUcuf_orim4.0may2.js
Size

546KB
Sample

220629-tkm4nsceh3
MD5

82c7d3a346d4d95a239d8013e814bcf7
SHA1

5478004d70f61a051831d264db4e9cf300f61e6f
SHA256

86b28e1c226290916f3e0dd50804286f50834c9496f840e0d84894f09b8324da
SHA512

a9978f357e7ec0a92e8d842fd131794022cfcd6a810a4a403764eacae6ec0c86bda7029a11329e5c3d2a87cfa7220000b9aa9f6bb2575f83583e1013c66d1d40

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5171883538:AAEyFWuNh68SJNNpkDCQbviRgrklZA3K4Qs/sendDocument

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

franmhort.duia.ro:8153

Mutex

Mutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
win.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  IVPzpgUcuf_orim4.0may2.js
- Size
  
  546KB
- MD5
  
  82c7d3a346d4d95a239d8013e814bcf7
- SHA1
  
  5478004d70f61a051831d264db4e9cf300f61e6f
- SHA256
  
  86b28e1c226290916f3e0dd50804286f50834c9496f840e0d84894f09b8324da
- SHA512
  
  a9978f357e7ec0a92e8d842fd131794022cfcd6a810a4a403764eacae6ec0c86bda7029a11329e5c3d2a87cfa7220000b9aa9f6bb2575f83583e1013c66d1d40
Score

10^/10

agenttesla asyncrat default collection keylogger rat spyware stealer suricata trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
  suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
  suricata
- suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
  suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
  suricata
- Async RAT payload
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2