agenttesla

General

Target
SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
Size 1.1MB
Sample221011-pll6jsebbq
SHA256 57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be
MD5 b7fcbb8bad6d0b7829a81cb09b5465f4
SHA1 445026eb5798cb7b19a4bb0981b4113dc5c4eb63
SHA512 a2b0397a484306d097b202bdb59b286ff459ad5fcab7e87648d500ffc088cdfc0a3135f271c946568d389e8ae8926795e1270c7336a078d126ad747bdfb28555
SSDEEP 24576:SNriy/fTF3wHsOzj4j85M1hUQDAxzJX44g07:SNtTisOzj4jGM1aK4FXy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

harjahwool.ddnsfree.com:8372

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-EGNT8M
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

warzonerat

C2

harjahwool.ddnsfree.com:2309

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1841252439:AAFeBNk12wAgfxXFXtqpw50JT4iCgTc-FsM/sendDocument

Targets

- Target
  SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
- Size 1.1MB
- SHA256 57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be
- MD5 b7fcbb8bad6d0b7829a81cb09b5465f4
- SHA1 445026eb5798cb7b19a4bb0981b4113dc5c4eb63
- SHA512 a2b0397a484306d097b202bdb59b286ff459ad5fcab7e87648d500ffc088cdfc0a3135f271c946568d389e8ae8926795e1270c7336a078d126ad747bdfb28555
- SSDEEP 24576:SNriy/fTF3wHsOzj4j85M1hUQDAxzJX44g07:SNtTisOzj4jGM1aK4FXy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost persistence rat agenttesla warzonerat collection evasion infostealer keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies WinLogon for persistence
  persistence
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- AgentTesla payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Warzone RAT payload
  rat
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2