agenttesla

General

Target

RE_BOEING3A78_NEW_ORDERS_E4G60K1G7_PDF.js
Size

466KB
Sample

210202-3gpqsqppmj
MD5

83ef3f626544cef2f0962863ab109634
SHA1

48d5a062ea59ea06afc5334a43f2537390660538
SHA256

5a18ef3e027b211901758fa2ffeaa63ae1ab87cdd85188660ab839771abb9ecb
SHA512

d9f127a33cb2a42b610e3f0e7ad057233e9491a37fc8342f92b216e6f1a3a470e26487bab74cb40209d5c084429db78152ed7266aaa1b56633aa0c6239c591e9

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.zolvtek.com/
Port:
21
Username:
origin@zolvtek.com
Password:
bird0006

Targets

- Target
  
  RE_BOEING3A78_NEW_ORDERS_E4G60K1G7_PDF.js
- Size
  
  466KB
- MD5
  
  83ef3f626544cef2f0962863ab109634
- SHA1
  
  48d5a062ea59ea06afc5334a43f2537390660538
- SHA256
  
  5a18ef3e027b211901758fa2ffeaa63ae1ab87cdd85188660ab839771abb9ecb
- SHA512
  
  d9f127a33cb2a42b610e3f0e7ad057233e9491a37fc8342f92b216e6f1a3a470e26487bab74cb40209d5c084429db78152ed7266aaa1b56633aa0c6239c591e9
Score

10^/10

agenttesla wshrat keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- WSHRAT
  WSHRAT is a variant of Houdini worm and has vbs and js variants.
  trojan wshrat
- WSHRAT Payload
- AgentTesla Payload
- Blocklisted process makes network request
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2