agenttesla

Sharing

Copy URL

Twitter E-mail

General

Target

https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.09.7z
Sample

240424-t8jq6add32

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.drivehq.com
Port:
21
Username:
donatopizza

Extracted

Family

modiloader

https://cdn.discordapp.com/attachments/753549570230976536/754626602951770172/Dpgibbn

Extracted

Family

emotet

Botnet

Epoch3

118.2.218.1:80

51.254.140.91:7080

5.9.227.244:8080

51.75.163.68:7080

75.127.14.170:8080

101.50.232.218:80

175.139.144.229:8080

139.59.12.63:8080

2.144.244.204:443

175.29.183.2:80

86.98.143.163:80

210.1.219.238:80

73.84.105.76:80

185.208.226.142:8080

91.75.75.46:80

188.251.213.180:443

88.249.181.198:443

77.74.78.80:443

181.137.229.1:80

190.136.179.102:80

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch1

128.92.203.42:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

190.188.245.242:80

12.163.208.58:80

213.197.182.158:8080

201.213.177.139:80

62.84.75.50:80

45.33.77.42:8080

185.183.16.47:80

78.249.119.122:80

177.129.17.170:443

51.15.7.189:80

152.169.22.67:80

119.106.216.84:80

109.169.12.78:80

51.15.7.145:80

219.92.13.25:80

190.117.79.209:80

rsa_pubkey.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
tt.swift@yandex.com
Password:
Sages101*

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.gautengelectrical.co.za
Port:
587
Username:
sales@gautengelectrical.co.za
Password:
*2wo)L6EXH7%
Email To:
clerf@keithwilliamgroup.com

Extracted

Family

systembc

knock0909.monster:4035

knock0909.xyz:4035

Targets

- Target
  
  https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.09.7z
Score

10^/10

agenttesla emotet lokibot masslogger modiloader njrat systembc zgrat epoch1 epoch3 banker collection evasion keylogger macro macro_on_action persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main payload
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- AgentTesla payload
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- ModiLoader First Stage
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Office macro that triggers on suspicious action
  Office document macro which triggers in special circumstances - often malicious.
  macro macro_on_action
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of SetThreadContext
behavioral1