agenttesla

General

Target

ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0
Size

1.3MB
Sample

240425-c1drhaea3z
MD5

69eaab67fd89a7dca0de1a2405d0df34
SHA1

e1d55aca4c9c6edce5a1301f678f09826af3670e
SHA256

ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0
SHA512

7c132d714c08a59d12f57f6b18669577a506398a87a9a050306a271c4be81975228d3e80a08ad7ba2d5cff1dd87ea7fff90ee3216b6cbaa009733930d5943140
SSDEEP

24576:nAHnh+eWsN3skA4RV1Hom2KXMmHap7d4DajNV+zfKw6F5E1ZkDhJFa5:ah+ZkldoPK8Yapu+35qSDh8

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

sub.thisisnot2abuse.xyz:2080

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PVWWU4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7124146126:AAGAbs9iw3XzfgH3tTN58djGN81AnAy9t-E/

https://api.telegram.org/bot5641014861:AAEm_7YGp9cbvOBbk5wT5BYfwW_Yl2L8a9Q/

Targets

- Target
  
  ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0
- Size
  
  1.3MB
- MD5
  
  69eaab67fd89a7dca0de1a2405d0df34
- SHA1
  
  e1d55aca4c9c6edce5a1301f678f09826af3670e
- SHA256
  
  ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0
- SHA512
  
  7c132d714c08a59d12f57f6b18669577a506398a87a9a050306a271c4be81975228d3e80a08ad7ba2d5cff1dd87ea7fff90ee3216b6cbaa009733930d5943140
- SSDEEP
  
  24576:nAHnh+eWsN3skA4RV1Hom2KXMmHap7d4DajNV+zfKw6F5E1ZkDhJFa5:ah+ZkldoPK8Yapu+35qSDh8
Score

10^/10

agenttesla remcos remotehost collection keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Remcos

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2