agenttesla

General

Target

bock.rar
Size

2.8MB
Sample

230615-k4qt8sfe73
MD5

a3392e425891c2b0c08dc5d6143487bc
SHA1

3c36ba83c9d891944072d6e17651c9b98a29ddbb
SHA256

52b0c7ba7b68715c8395e51206038b134df91ff61fea0cfeaeed1f500fef5531
SHA512

48447db50093a1f75b8909b67b63f600cf25861da20275403351805cf8b0517f2049ec6e614c22b1fc72d63dcf5bcd6204b2f370c32bb15009dfa7a5f45b7c79
SSDEEP

49152:YlZxNwQ1ghwl+mIT5POcUf0RwO02SM5z+nyyywPlrzaEIlJSvFmVMpfqorq:Y1NwQ1H0m2ROcUMRO/Mhn0PlnaEmJSve

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.rzr0ngtai.com
Port:
587
Username:
menu@rzr0ngtai.com
Password:
bhYdc$I2
Email To:
menu@rzr0ngtai.com

Targets

- Target
  
  bock/68h36s.js
- Size
  
  3.4MB
- MD5
  
  3b959fc03975f45aa625b6a1f43ad1e7
- SHA1
  
  108be164a2b0419fa90dbfb84e20c43148786e31
- SHA256
  
  3865bbd46883751b05019a0479e8367cbc91d14e04ad915a79f6408df78d5cad
- SHA512
  
  4ad6850c0da013ed3538d50f99e4b79ecf7c748f7f4a40c52a8ec37c1e9845871e82a9edb914b339f2e4a49f5e034a30ae4462bc624752df3c3f3b2c8fd95a3d
- SSDEEP
  
  24576:vJTSZkTHrXCowam0gGHmjSGszTwn3ztdCPBItPbQTQgIO34L3HMWcscZq4KZ4YMS:HE5
Score

10^/10

agenttesla vjw0rm collection keylogger spyware stealer trojan worm
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2
- Target
  
  bock/6rdchb.exe
- Size
  
  6.1MB
- MD5
  
  43d1bfe3d7998a15b3f315493281336e
- SHA1
  
  8bce78b3e120f8e96e0e896f04e77d64291a1d39
- SHA256
  
  27e8311a78358fac78a90f16012fb37e44ba7a57243346aefad8ca6e069b8d60
- SHA512
  
  67b355dddc9a5bd91ade586b369145475e13a5125a07bc1bc70067b08a9dd2b1c57ab2505c56151f70b54b6d4139354604f0fc1b66729245da3989c773bada71
- SSDEEP
  
  49152:6Bf8QvuxNDfrb/TAvO90d7HjmAFd4A64nsfJLppiGr6KsUKfnNo2l15AoBfVB5uK:vNtQNXL4N63ENr
Score

1^/10
behavioral3 behavioral4