agenttesla

Sharing

Copy URL

Twitter E-mail

General

Target

bomb.exe.zip
Size

4KB
Sample

240807-1ne1ssyape
MD5

814538a1573b8df19f7f110392ce393d
SHA1

152fc8b65388b59da9c8743c64bb8773dda60bfa
SHA256

3f50821e75438309214415a60245529318ef95d4c86bde2e65cb65d5e92cb7da
SHA512

71cb79c405377dbf7b32bd12c378daab6855ed8af7c8967f8e50dc8e3f698890d5309e19cf3d44e3148e6a663d534832794415014176488723111d0323378a00
SSDEEP

96:OhMjbwQROK0RKz1Eu6SxB6JdysqDAbszKoddVesqFKg6WYof9w4AqOAPdc7x40:V+R+16SxwdcDAbszxqmxoe4AqvPg

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.synergyinnovationsgroup.com
Port:
587
Username:
[email protected]
Password:
C@p-Y8BoHc#?

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
yUiavQX8

Extracted

Credentials

Protocol: smtp
Host:
mail.blooming.com.my
Port:
587
Username:
[email protected]
Password:
THL191282

Extracted

Credentials

Protocol: smtp
Host:
smtp.progestionperu.com
Port:
587
Username:
[email protected]
Password:
Progestionperu2017

Extracted

Credentials

Protocol: smtp
Host:
smtp.aw.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
manabon0512

Extracted

Credentials

Protocol: smtp
Host:
ca.thn.ne.jp
Port:
587
Username:
[email protected]
Password:
puf73iej

Extracted

Credentials

Protocol: smtp
Host:
smtp.af.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
popipal9

Extracted

Credentials

Protocol: smtp
Host:
mail.jttk.zaq.ne.jp
Port:
587
Username:
[email protected]
Password:
momosaku0926

Extracted

Credentials

Protocol: smtp
Host:
smtp.uu.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
ux5mqkie

Extracted

Credentials

Protocol: smtp
Host:
smtp.oo.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
2giwniwa

Extracted

Credentials

Protocol: smtp
Host:
mail.ai.ayu.ne.jp
Port:
587
Username:
[email protected]
Password:
8p9s4i4qq

Extracted

Credentials

Protocol: smtp
Host:
ab.thn.ne.jp
Port:
587
Username:
[email protected]
Password:
mbs5co3z

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.blooming.com.my
Port:
587
Username:
[email protected]
Password:
THL191282

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.synergyinnovationsgroup.com
Port:
587
Username:
[email protected]
Password:
C@p-Y8BoHc#?
Email To:
[email protected]

Extracted

Family

quasar

Version

1.4.1

Botnet

duder1234

asd123123.zapto.org:4782

Mutex

0b2f89f9-0512-464a-8ed5-7c7b92e47150

Attributes

encryption_key
CACF16743B18545EC9FE5512A605B86F4128B37D
install_name
windowsManager32.exe
log_directory
Logs
reconnect_delay
3000
startup_key
windowsman32
subdirectory
windows

Targets

- Target
  
  bomb.exe.zip
- Size
  
  4KB
- MD5
  
  814538a1573b8df19f7f110392ce393d
- SHA1
  
  152fc8b65388b59da9c8743c64bb8773dda60bfa
- SHA256
  
  3f50821e75438309214415a60245529318ef95d4c86bde2e65cb65d5e92cb7da
- SHA512
  
  71cb79c405377dbf7b32bd12c378daab6855ed8af7c8967f8e50dc8e3f698890d5309e19cf3d44e3148e6a663d534832794415014176488723111d0323378a00
- SSDEEP
  
  96:OhMjbwQROK0RKz1Eu6SxB6JdysqDAbszKoddVesqFKg6WYof9w4AqOAPdc7x40:V+R+16SxwdcDAbszxqmxoe4AqvPg
Score

10^/10

agenttesla phorphiex quasar snakekeylogger duder1234 bootkit collection credential_access defense_evasion discovery evasion execution keylogger loader persistence pyinstaller spyware stealer trojan upx worm
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies security service
  evasion
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1