agenttesla

General

Target

Спецификация_продукта_прилагается.pdf.exe
Size

628KB
Sample

240523-wzxb1abf92
MD5

b7649e5cb8035e0d62e3275244bc0c21
SHA1

d39f5c06a58a53002cce5db542a70a7ceba843b7
SHA256

ab182aba5412399f9e5f505bb3d8d145458fb108473fafbdbed740eae40738f8
SHA512

610432d57c326de6fbb3f9d0bbdb8023e556f2cda2f7b011d7ca5d9e5c2f308c8d9665aa9cd075f071c0f8916b8dbd10172ab2b02be477dea4fb27f09c7decc3
SSDEEP

12288:U++oXh1udZSqk9nk3kJQZsOcnSpDahm/GRkLB1wR2wveenfRCFFUems8iDguPB:7Xh1eZNktakJQZyAec4g62qfRCFFpkKh

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.brusln.com
Port:
587
Username:
[email protected]
Password:
Countrycode@2024

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.brusln.com
Port:
587
Username:
[email protected]
Password:
Countrycode@2024
Email To:
[email protected]

Targets

- Target
  
  Спецификация_продукта_прилагается.pdf.exe
- Size
  
  628KB
- MD5
  
  b7649e5cb8035e0d62e3275244bc0c21
- SHA1
  
  d39f5c06a58a53002cce5db542a70a7ceba843b7
- SHA256
  
  ab182aba5412399f9e5f505bb3d8d145458fb108473fafbdbed740eae40738f8
- SHA512
  
  610432d57c326de6fbb3f9d0bbdb8023e556f2cda2f7b011d7ca5d9e5c2f308c8d9665aa9cd075f071c0f8916b8dbd10172ab2b02be477dea4fb27f09c7decc3
- SSDEEP
  
  12288:U++oXh1udZSqk9nk3kJQZsOcnSpDahm/GRkLB1wR2wveenfRCFFUems8iDguPB:7Xh1eZNktakJQZyAec4g62qfRCFFpkKh
Score

10^/10

agenttesla evasion execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Looks for VirtualBox Guest Additions in registry
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2