agenttesla

General

Target

PowerCheat free.exe
Size

8.0MB
Sample

240612-xydnyawgkc
MD5

63e3124b3360f64808cddb6b5b7dd0b7
SHA1

b5308a58f50c548c66b1c46543537812605b6973
SHA256

3e96e5c7ce88b7a27dbdb0341fe7dc7edd69cfeaba35b7b3019731de8ed81840
SHA512

f57876faf30d4c5e8794bf5e1c70747ca58c629df54f121339cbb6444df2cfa13315952233e32471448b5c919b62147ea70af7d66262ce1658fd9d87cea06f4f
SSDEEP

196608:o/TYUOztYQC4wmOH2dWJMiUb5zBXVnTpkSIgzeRnZYk:kWzupHjJdwbdkSpzYZYk

Score

10^/10

Malware Config

Targets

- Target
  
  PowerCheat free.exe
- Size
  
  8.0MB
- MD5
  
  63e3124b3360f64808cddb6b5b7dd0b7
- SHA1
  
  b5308a58f50c548c66b1c46543537812605b6973
- SHA256
  
  3e96e5c7ce88b7a27dbdb0341fe7dc7edd69cfeaba35b7b3019731de8ed81840
- SHA512
  
  f57876faf30d4c5e8794bf5e1c70747ca58c629df54f121339cbb6444df2cfa13315952233e32471448b5c919b62147ea70af7d66262ce1658fd9d87cea06f4f
- SSDEEP
  
  196608:o/TYUOztYQC4wmOH2dWJMiUb5zBXVnTpkSIgzeRnZYk:kWzupHjJdwbdkSpzYZYk
Score

10^/10

agenttesla umbral execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect Umbral payload
- Modifies WinLogon for persistence
  persistence
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- AgentTesla payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies AppInit DLL entries
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1