agenttesla

General

Target

Copy7510785002.exe
Size

4.7MB
Sample

240515-r2e4aaeb57
MD5

40015adb59181ae2bc09e0f271373188
SHA1

f1690da2e26e5a7d31d3cce7b74a6185f60333f5
SHA256

4bcc19c324294a3b92ed5067ca495f51a05362edcb2cf7c09d8619842a25a99c
SHA512

e5cbf81c29bb44dbee01474e15bef92211f70b57f91489ca963e0f91cab7077081453ee2d2f833e7002d96fd0bdd8a70af3263d4ec548f2af22e4a672a893145
SSDEEP

24576:ULwV1goQrA9eYALPzgpICbdW/G/4ceP81kxr/wKXo4p/PGqA/v3MnU2ZRZhRVHTa:U0Vn

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
66.29.151.236
Port:
587
Username:
[email protected]
Password:
s9jjoVvaZchS

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

April3rd2024

C2

94.156.65.181:3434

Mutex

A234sdgrgMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
66.29.151.236
Port:
587
Username:
[email protected]
Password:
s9jjoVvaZchS
Email To:
[email protected]

Targets

- Target
  
  Copy7510785002.exe
- Size
  
  4.7MB
- MD5
  
  40015adb59181ae2bc09e0f271373188
- SHA1
  
  f1690da2e26e5a7d31d3cce7b74a6185f60333f5
- SHA256
  
  4bcc19c324294a3b92ed5067ca495f51a05362edcb2cf7c09d8619842a25a99c
- SHA512
  
  e5cbf81c29bb44dbee01474e15bef92211f70b57f91489ca963e0f91cab7077081453ee2d2f833e7002d96fd0bdd8a70af3263d4ec548f2af22e4a672a893145
- SSDEEP
  
  24576:ULwV1goQrA9eYALPzgpICbdW/G/4ceP81kxr/wKXo4p/PGqA/v3MnU2ZRZhRVHTa:U0Vn
Score

10^/10

zgrat persistence rat agenttesla asyncrat april3rd2024 keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Async RAT payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2