General
- Target ago.exe
- Size 301KB
- Sample201109-381r69kncx
- SHA256 aeb35fd257a06bac1292f898a40223bc3e834b375b0314731fca930155b7d4e8
- MD5 219bdb6626fe5d273aaf2c06eca70a87
- SHA1 1c7a42d2f425ef605976d83ce177190082f1c306
- SHA512 f0162e4c3836009feee06629d5968501c2d603a24e47b37ea764ae5833545a07de3fd046cbc9cf71982a5a7aca838ead1434a9b8637baa7bae844ecdee2b2922
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
ago.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ago.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
server257.web-hosting.com
-
Port
587
-
Username
-
Password
mOz(?wWDbVA8
Targets
-
- Target ago.exe
- Size 301KB
- SHA256 aeb35fd257a06bac1292f898a40223bc3e834b375b0314731fca930155b7d4e8
- MD5 219bdb6626fe5d273aaf2c06eca70a87
- SHA1 1c7a42d2f425ef605976d83ce177190082f1c306
- SHA512 f0162e4c3836009feee06629d5968501c2d603a24e47b37ea764ae5833545a07de3fd046cbc9cf71982a5a7aca838ead1434a9b8637baa7bae844ecdee2b2922
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.