agenttesla

General

Target

8952044c2aaf34f25d38158abd3234fb58029512620015bb1441bf91cb7c9990
Size

633KB
Sample

240515-ckad5scb7s
MD5

0ef239280c0a4b781bfb66994ffbb140
SHA1

d80fa17c44b4d4ecbb3e8e3486030f1c8e1bf118
SHA256

8952044c2aaf34f25d38158abd3234fb58029512620015bb1441bf91cb7c9990
SHA512

b4d8bcb0677063cc6c883446a99ffff74dc66fed16eb570b493eed00b400ba6271953db65f1340bdf2ab838798ba0453fcdfbc9d74a0008dd0a8babfea7d2877
SSDEEP

12288:UFIg6SKlpxf4WfM1QtfdpWlFdMoN5vix/W01s35RcESdy5TMXCKssG:3LlpxfFM1Qt+FdMoNN6R1sp2DsQXZG

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.valtronics-ae.com
Port:
587
Username:
[email protected]
Password:
DhdXcLr4

Targets

- Target
  
  8952044c2aaf34f25d38158abd3234fb58029512620015bb1441bf91cb7c9990
- Size
  
  633KB
- MD5
  
  0ef239280c0a4b781bfb66994ffbb140
- SHA1
  
  d80fa17c44b4d4ecbb3e8e3486030f1c8e1bf118
- SHA256
  
  8952044c2aaf34f25d38158abd3234fb58029512620015bb1441bf91cb7c9990
- SHA512
  
  b4d8bcb0677063cc6c883446a99ffff74dc66fed16eb570b493eed00b400ba6271953db65f1340bdf2ab838798ba0453fcdfbc9d74a0008dd0a8babfea7d2877
- SSDEEP
  
  12288:UFIg6SKlpxf4WfM1QtfdpWlFdMoN5vix/W01s35RcESdy5TMXCKssG:3LlpxfFM1Qt+FdMoNN6R1sp2DsQXZG
Score

10^/10

agenttesla zgrat collection evasion execution keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- AgentTesla payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2