agenttesla

General

Target

Cr@ck tool pro.exe
Size

4.7MB
Sample

240910-1pwd6sycka
MD5

1411e082c0aeffd915d371b2fbee1682
SHA1

00de4b0cf8892be0089b1ea4d132305fb5cce878
SHA256

01dfd0c323936653e13e1d265c6a14dae14cdd7339f03e684bf813cfbb5f61e5
SHA512

0cab0d5776494b5acebd52d3afbfba049eec0715ddcc37683ba94d3bc001975e760fb63fd52a6fcaa4b8469b8474857c5fb66370c273b302bbcd450e1e8c4fef
SSDEEP

98304:bEP5pLPl9THktuqoaH7ykjy+75Mko7EUKKEqX7E9E8EEEEEEEEEEEEEEEEEEEEE0:bW5pLPl5vabyGBakoIfYrLtKHEyU7e

Score

10^/10

Malware Config

Targets

- Target
  
  Cr@ck tool pro.exe
- Size
  
  4.7MB
- MD5
  
  1411e082c0aeffd915d371b2fbee1682
- SHA1
  
  00de4b0cf8892be0089b1ea4d132305fb5cce878
- SHA256
  
  01dfd0c323936653e13e1d265c6a14dae14cdd7339f03e684bf813cfbb5f61e5
- SHA512
  
  0cab0d5776494b5acebd52d3afbfba049eec0715ddcc37683ba94d3bc001975e760fb63fd52a6fcaa4b8469b8474857c5fb66370c273b302bbcd450e1e8c4fef
- SSDEEP
  
  98304:bEP5pLPl9THktuqoaH7ykjy+75Mko7EUKKEqX7E9E8EEEEEEEEEEEEEEEEEEEEE0:bW5pLPl5vabyGBakoIfYrLtKHEyU7e
Score

10^/10

agenttesla xmrig defense_evasion discovery evasion execution keylogger miner persistence spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- AgentTesla payload
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1