agenttesla

General

Target

7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6.exe
Size

733KB
Sample

240425-b2d8zsdb3z
MD5

23e189bd0552c1601a8e0f9ba8d15c86
SHA1

4094f42d511ab76f00f62dad7d40d42015e87651
SHA256

7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6
SHA512

f83e3386b8175359b4b8a6fb9d8e692b1ea427215005064766198fa9667c276117eedff8977a76977604043370d44aa4514605946ae8eb22ec1ef339018c1100
SSDEEP

12288:bdFkDzZLeZIasnetaFPWpOiDF/5zGSQVQ/Z9l:bdu/ZoIa6etaFPWpOiDF/Oy3l

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pmknycc.in
Port:
587
Username:
[email protected]
Password:
Host@@2020
Email To:
[email protected]

Targets

- Target
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6.exe
- Size
  
  733KB
- MD5
  
  23e189bd0552c1601a8e0f9ba8d15c86
- SHA1
  
  4094f42d511ab76f00f62dad7d40d42015e87651
- SHA256
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6
- SHA512
  
  f83e3386b8175359b4b8a6fb9d8e692b1ea427215005064766198fa9667c276117eedff8977a76977604043370d44aa4514605946ae8eb22ec1ef339018c1100
- SSDEEP
  
  12288:bdFkDzZLeZIasnetaFPWpOiDF/5zGSQVQ/Z9l:bdu/ZoIa6etaFPWpOiDF/Oy3l
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with or use KoiVM
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2