agenttesla

General

Target

eedce8e0d2a8686ea8d6f9b10ef65c2a4594e7a371f83bff590e4c001b780381
Size

415KB
Sample

220701-ghtgfsgce9
MD5

25be29d12e9b11853ef562d973ab8a1f
SHA1

1b248f2af6a1bd8c9ba1abff200fa54d69abefdd
SHA256

eedce8e0d2a8686ea8d6f9b10ef65c2a4594e7a371f83bff590e4c001b780381
SHA512

18b56f2a9f68bb78ed979d48e96dfdcbda204ce66b09c31fd3d207fc33358485ff7fc8832251d81b07055795ae1a7d5ef5959dff76729e04d78659ecaee45013

Score

10^/10

Malware Config

Targets

- Target
  
  eedce8e0d2a8686ea8d6f9b10ef65c2a4594e7a371f83bff590e4c001b780381
- Size
  
  415KB
- MD5
  
  25be29d12e9b11853ef562d973ab8a1f
- SHA1
  
  1b248f2af6a1bd8c9ba1abff200fa54d69abefdd
- SHA256
  
  eedce8e0d2a8686ea8d6f9b10ef65c2a4594e7a371f83bff590e4c001b780381
- SHA512
  
  18b56f2a9f68bb78ed979d48e96dfdcbda204ce66b09c31fd3d207fc33358485ff7fc8832251d81b07055795ae1a7d5ef5959dff76729e04d78659ecaee45013
Score

10^/10

agenttesla collection keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- AgentTesla Payload
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2