agenttesla

General

Target
file.exe
Size 200KB
Sample230120-q9ayvsba74
SHA256 d0dcb0eee1b8b7f5b54cf5b26a04ec74e588918bb47e7ea738cd2548410c9b85
MD5 faca198da73c4f3811312a59d264422b
SHA1 fc5fb373ad3f752c3eb627f847140f3ef27f08d3
SHA512 bd1474c2ac18fb2ecdca60187059ee9d172604b50514159c05792d7a37f5797afcf690500e23565c4470b19fee19e5abfe2ef01c4731db6f283a98907713d6bd
SSDEEP 6144:k9VyyHz2UZqMD/1m1Y3QNKQmvZdTMEcYi:YyyHzRe/0S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 200KB
- SHA256 d0dcb0eee1b8b7f5b54cf5b26a04ec74e588918bb47e7ea738cd2548410c9b85
- MD5 faca198da73c4f3811312a59d264422b
- SHA1 fc5fb373ad3f752c3eb627f847140f3ef27f08d3
- SHA512 bd1474c2ac18fb2ecdca60187059ee9d172604b50514159c05792d7a37f5797afcf690500e23565c4470b19fee19e5abfe2ef01c4731db6f283a98907713d6bd
- SSDEEP 6144:k9VyyHz2UZqMD/1m1Y3QNKQmvZdTMEcYi:YyyHzRe/0S
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla neshta collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2