agenttesla

General

Target

Shipping Invoice & BL.xlsx
Size

358KB
Sample

211028-ltzj3afhcr
MD5

4db752c789a2038d78d8067db7c6f79c
SHA1

dce36fecfd52b3df8dd134f0dbc0e2d36a0a114d
SHA256

c2c8ddcbdbed110a1b07aa3180297125eb82353ddadbc540b92e7ee2f1cb4574
SHA512

c04bb6a0b48296843e3e9c507b942d44de1003d418201f82d49b05b8fd81738675cc4ca4441ee3d15016cc56ec0a804db114350b6322f9aef5b3b00aabcb700e

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.enerzi.co
Port:
587
Username:
[email protected]
Password:
Enerzis@123!#

Targets

- Target
  
  Shipping Invoice & BL.xlsx
- Size
  
  358KB
- MD5
  
  4db752c789a2038d78d8067db7c6f79c
- SHA1
  
  dce36fecfd52b3df8dd134f0dbc0e2d36a0a114d
- SHA256
  
  c2c8ddcbdbed110a1b07aa3180297125eb82353ddadbc540b92e7ee2f1cb4574
- SHA512
  
  c04bb6a0b48296843e3e9c507b942d44de1003d418201f82d49b05b8fd81738675cc4ca4441ee3d15016cc56ec0a804db114350b6322f9aef5b3b00aabcb700e
Score

10^/10

agenttesla collection keylogger persistence spyware stealer suricata trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- AgentTesla Payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2