agenttesla

General

Target

b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe
Size

986KB
Sample

240522-ckh2aagh83
MD5

4d69a6b1a835e13d9399fc7a3fcd1c7f
SHA1

dabeb84fb579d1b1fd8efffd3f75ec5e5d5c6297
SHA256

b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212
SHA512

01900903b402511922c3d3a3eac3b217f49c19e6f245ac250f01614cc3b7f89975f412a96c648c48c8b1641cf5af61707d0261f4656ce48f3a8739436102d59b
SSDEEP

12288:67t9TgXF/OHYMhHQy9J9cv2N3TApMDcMs9cs46uxDscaK7JGfhJef98WXRAEz1T+:67btH9iyd90pMDRRuvQJKQfGwaERT5E

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6471994916:AAHkdjLXxo_sOhOEXeFpgGf4NrHiZGX6HD8/

Targets

- Target
  
  b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe
- Size
  
  986KB
- MD5
  
  4d69a6b1a835e13d9399fc7a3fcd1c7f
- SHA1
  
  dabeb84fb579d1b1fd8efffd3f75ec5e5d5c6297
- SHA256
  
  b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212
- SHA512
  
  01900903b402511922c3d3a3eac3b217f49c19e6f245ac250f01614cc3b7f89975f412a96c648c48c8b1641cf5af61707d0261f4656ce48f3a8739436102d59b
- SSDEEP
  
  12288:67t9TgXF/OHYMhHQy9J9cv2N3TApMDcMs9cs46uxDscaK7JGfhJef98WXRAEz1T+:67btH9iyd90pMDRRuvQJKQfGwaERT5E
Score

10^/10

execution agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with or use KoiVM
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Looks for VirtualBox Guest Additions in registry
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2