agenttesla

General

Target

d83d3c00278786c0502a541718570ecb_JaffaCakes118
Size

480KB
Sample

240910-n7mhrsvcph
MD5

d83d3c00278786c0502a541718570ecb
SHA1

103b5b0925d792c9474354c1238dce57a4cb5053
SHA256

03f816c1b3c9383ca81920ee0377c507f0c70f84b2eb6a04b0566214856bc007
SHA512

ea8777ab98c99c7125f806f9a9177370b378a30d2353f2a347041ba0144aa8e6b84c07dac218f14400ea1ba19e3e5a76260ed72d32f566340673d902e59ba6ae
SSDEEP

12288:BCC4zUGgKIOKF6GuCflmq03G3hqtuGrkDe28W3K:J4zjpZOKQhqsGrkDe283

Score

10^/10

Malware Config

Targets

- Target
  
  Reuest For Quotation And Sow.exe
- Size
  
  533KB
- MD5
  
  8a015eede84ea4c519ed77e3509670d7
- SHA1
  
  0e42bb5ecdd266fd5f05c20cd863eac325c8163b
- SHA256
  
  f408de869853bef67d90d13c4c3890fcef1c3a0c5ce03c9d71b7f1bda61a0d8f
- SHA512
  
  e5bb02650ca5c83415fcec1a48157bd03c698366f5c8da36a47abf11df0b26fd82949032c834ba83c463b42f5cfe8d5fd6ab87fc1f81383858654eba5fc429f7
- SSDEEP
  
  12288:gSc3xPskyO5travAPacMYxbDq9dxC+en9sQNxS:gSchPsVOznnMYxbDQd4nK
Score

10^/10

agenttesla collection credential_access discovery evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2