agenttesla

General

Target

60771c2c39b8d81db81e781a1f497f1a402f9f95843471f6bf1aaf8d5f1771d9.exe
Size

1.0MB
Sample

240523-by2vwaha44
MD5

0f05c6fa209e5a03cfffb97831a2a041
SHA1

6df1cdab62e9b0fd902705664d2ad6d8e219d4c6
SHA256

60771c2c39b8d81db81e781a1f497f1a402f9f95843471f6bf1aaf8d5f1771d9
SHA512

01a60f285f33608bf12f59e53cf12e9267ebca213046ab7f0a61b75bc5650d51858d7ea0335c7ee3130b591ceecba5e1e62eceae9de339f29f02cbbb38b4b973
SSDEEP

12288:b4i8LkpEaLO67JUMtVcNA4QfCCUGYOVzb7hjOEHzfApWcFTWzDpmobjwkR:DjEZ67PVOAHCJGBb79Hz5cFqHj3

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.naveentour.com
Port:
587
Username:
[email protected]
Password:
nav!T6u2@001
Email To:
[email protected]

Targets

- Target
  
  60771c2c39b8d81db81e781a1f497f1a402f9f95843471f6bf1aaf8d5f1771d9.exe
- Size
  
  1.0MB
- MD5
  
  0f05c6fa209e5a03cfffb97831a2a041
- SHA1
  
  6df1cdab62e9b0fd902705664d2ad6d8e219d4c6
- SHA256
  
  60771c2c39b8d81db81e781a1f497f1a402f9f95843471f6bf1aaf8d5f1771d9
- SHA512
  
  01a60f285f33608bf12f59e53cf12e9267ebca213046ab7f0a61b75bc5650d51858d7ea0335c7ee3130b591ceecba5e1e62eceae9de339f29f02cbbb38b4b973
- SSDEEP
  
  12288:b4i8LkpEaLO67JUMtVcNA4QfCCUGYOVzb7hjOEHzfApWcFTWzDpmobjwkR:DjEZ67PVOAHCJGBb79Hz5cFqHj3
Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2