agenttesla

General

Target

bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d
Size

747KB
Sample

220520-3wkmcshfc4
MD5

c6817b4020f57d6e3048735d52e9badb
SHA1

57dbc287762d2c7f226b8887fd9ed8bcc46f93af
SHA256

bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d
SHA512

9c3ebe47707cab7de6687452655664675d2f17991ce8ed37c050c88baa78002c44588df9d4922f13788e69cfcccce707184bd4eacf59cf100c0751838e58ef0e

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.aylaalgan.com.tr
Port:
587
Username:
[email protected]
Password:
20162016

Extracted

Credentials

Protocol: smtp
Host:
mail.aylaalgan.com.tr
Port:
587
Username:
[email protected]
Password:
20162016

Targets

- Target
  
  PO#2207020 p2.bat
- Size
  
  472KB
- MD5
  
  3f3ffffb3df0dd6d10b540fd78f87e18
- SHA1
  
  d1d384f586d649e82dab478b935c68c111ed3115
- SHA256
  
  8b54843b4acb823d224d090a1c2246860d643318959d95fa342b588fcba6a0c4
- SHA512
  
  6bab494acd0a74152a276533881a2141ef51794530b9451f27e123a9d8fc9e9bd4f624af8a61035839246daa5ca4fe30acdd9183c71875b9275c72f98b9122b5
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  PO#2207020.bat
- Size
  
  476KB
- MD5
  
  ce5c25d462cbef99251c3a8984f9fbdc
- SHA1
  
  0bf44e4fb8764de6480d5a18c98c668d55da00f9
- SHA256
  
  018655556fe0544b51a8c4ed1a6a4e3845a6acfe8635fb4b7f304d6f4f845d8b
- SHA512
  
  47c15c543654dc493bc2fbc4a2752ab071b50282689e8f4135fcfbb72e48848c190300f5473c63c7c13bd87a3957a5c746fad48dacfaaf49a96ba1823854a742
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4