agenttesla

General

Target

b9ff68d1e5f12ea6138a81bccaa9f6c892b9db34b39ce0d184d163af83769d02.zip
Size

599KB
Sample

240425-cceznadb96
MD5

0334e0c91b331c229c4d75542ae16d8f
SHA1

a31d1314af7e2157e57cc21ef2d70f5eed9227ed
SHA256

b9ff68d1e5f12ea6138a81bccaa9f6c892b9db34b39ce0d184d163af83769d02
SHA512

0923dafb429b6c40fc41663408811a301d3afef3abda6dcbc572ed567414f81c5bf6aa63ba6773aaca4f910494a5a882c14be586537e6a5097841d33b0f41cc0
SSDEEP

12288:fWKXxTVNv5g+3W5/PQFnrUb23JRrQ3iDlyYmuSZscbKn51jxsKbV:fpXxpV5H3W5/YFE+QuyY9Y4HZV

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bonnyriggdentalsurgery.com.au
Port:
587
Username:
[email protected]
Password:
Sages101*
Email To:
[email protected]

Targets

- Target
  
  SARL RABINEAU Order FA2495.exe
- Size
  
  609KB
- MD5
  
  4ac88ef7fe497d568f8c0256627f4f28
- SHA1
  
  ed66aadb1b165388e5a132f43874f385db546379
- SHA256
  
  034a3732828ad09b79a12c66bf7eee3058427808bdae8b19291fffc828ee1fbf
- SHA512
  
  b20a18998275e42a27aa56ff0318e2a119b00a5ffee04898e42c25524ee4abf1e68952c97236d4ecafdd143a9912d87f15e463ea3e62ac1bc028e9bbac54fbab
- SSDEEP
  
  12288:IxbVNv5uSru57PQFztYF2vLRHQ36D78MmeOZWczK3rlHxsKIy:IxRV5Lru57YF+iQe8MdM0JOy
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables packed with or use KoiVM
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2