agenttesla

General

Target

02a113310c4b7d8b1b47afeff0f4df059d212400b29edba2b0e5754dd4748289
Size

1.8MB
Sample

250212-p7lf5ssjfk
MD5

f2844738ccf76ce8bd040cb4b8af294b
SHA1

e32a49420679ea5922cf1648cff46909243cc370
SHA256

02a113310c4b7d8b1b47afeff0f4df059d212400b29edba2b0e5754dd4748289
SHA512

8eab5dfa8f37139bbd9476e48ffeda562b09231ff4d98b85dfdf0deaea4d83acd9850f807700f36f028dbe7d392231165c6319651dd80626af9b12290cdfc24e
SSDEEP

49152:vc6zng2TaAAmo/SevAFQc6zng2TaAAmo/SevAFv:v3cMo6jQ3cMo6jv

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

FEB 09

C2

oktoviyanto.ddns.net:9373

103.186.117.61:9373

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Z2L02T
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
evqqlnwkcmogylje

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
evqqlnwkcmogylje

Targets

- Target
  
  Bukti_Transfer...WU.exe
- Size
  
  1.0MB
- MD5
  
  e48ca032affdeea3ee88874ed39c4dcd
- SHA1
  
  ca3e925e87dc3bc5bd1878bc9d74cd709d7a9622
- SHA256
  
  21224cc236d63c5d3d7d3f80be375d3c2408f7a91b08eb6a16d70c7db21106d9
- SHA512
  
  4a727c97e2af20c296f01f89953fc20908d628cc97c4fa372d15d003427c5f0e2b2146d214df4a22b8b62fb46f121df0021cb18056bfba6c7ec824c892b3da53
- SSDEEP
  
  24576:D+wIZTFg2BK8sgD08CwrjYFMIzsBk6tkAfiRN+BU:D+wIZTOBRgDhnY2M6tV6RND
Score

10^/10

agenttesla remcos feb 09 collection discovery execution keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Bukti_Transfer..WU.exe
- Size
  
  1.0MB
- MD5
  
  e48ca032affdeea3ee88874ed39c4dcd
- SHA1
  
  ca3e925e87dc3bc5bd1878bc9d74cd709d7a9622
- SHA256
  
  21224cc236d63c5d3d7d3f80be375d3c2408f7a91b08eb6a16d70c7db21106d9
- SHA512
  
  4a727c97e2af20c296f01f89953fc20908d628cc97c4fa372d15d003427c5f0e2b2146d214df4a22b8b62fb46f121df0021cb18056bfba6c7ec824c892b3da53
- SSDEEP
  
  24576:D+wIZTFg2BK8sgD08CwrjYFMIzsBk6tkAfiRN+BU:D+wIZTOBRgDhnY2M6tV6RND
Score

10^/10

remcos feb 09 discovery execution rat spyware stealer agenttesla collection credential_access keylogger persistence trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4