agenttesla

General

Target

ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36.exe
Size

777KB
Sample

240523-cbm9mshf62
MD5

d96260136e9989c3ee56e2fef804175e
SHA1

ba76e6c03a5485166cf0bc9bfd7b5ff34a684a5b
SHA256

ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36
SHA512

4c6dd05630206e2a9292bb0c569f4f450aa6b3be749e056eddd42f86cfe5f2790c8c305e0f5e31a12ee8e90522767563a195a90d75bb2043476a26d54494649c
SSDEEP

12288:t5Zhg/9yOnhNzHxepY9oCfO2iiCw+vokWCotbleaQVBmWJzrGtLAgReWjGT43Zqb:+ThNzg29oGO2iaYWjtb5G/

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.desirebeverage.com
Port:
587
Username:
[email protected]
Password:
Ecom@779
Email To:
[email protected]

Targets

- Target
  
  ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36.exe
- Size
  
  777KB
- MD5
  
  d96260136e9989c3ee56e2fef804175e
- SHA1
  
  ba76e6c03a5485166cf0bc9bfd7b5ff34a684a5b
- SHA256
  
  ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36
- SHA512
  
  4c6dd05630206e2a9292bb0c569f4f450aa6b3be749e056eddd42f86cfe5f2790c8c305e0f5e31a12ee8e90522767563a195a90d75bb2043476a26d54494649c
- SSDEEP
  
  12288:t5Zhg/9yOnhNzHxepY9oCfO2iiCw+vokWCotbleaQVBmWJzrGtLAgReWjGT43Zqb:+ThNzg29oGO2iaYWjtb5G/
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2