agenttesla

General

Target

Sales confirmation-a13802KA.docx
Size

10KB
Sample

230419-jp4l4shb82
MD5

aa17844cf349edcb703a84874bf9b51f
SHA1

9c894354e8aac4c58f111c7405a3f92d93d3da4f
SHA256

e2f7f94897d3c542e882840cd25955f9bf9e1b1507955ee144bdf939adcce73e
SHA512

a3ac31637f009b6a717999a60dcc2c5ff032db791ef5c808654b728a7746f6353f3976ab44cb5bbc97e99e1ac87f57af8433076c23dc4c595d69768bcf2f9424
SSDEEP

192:ScIMmtPGT7G/bIwXOVOtlrV5SEzBC4vNq6sM63kp:SPXuT+xXOVOTbhlqHI

Score

10^/10

Malware Config

Extracted

Rule

Microsoft Office WebSettings Relationship

C2

http://%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%2IIOOOWOEOEOEOEOEOEOISISODOEOEOEOODOOOOOOWWOWOQQQOWOWOWOWOIIIDIIFIFIWOEOEOEOIFIDIFODFI@3221468051/r/%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.strictfacilityservices.com
Port:
587
Username:
accounts@strictfacilityservices.com
Password:
SFS!@#321
Email To:
zamanic62@gmail.com

Targets

- Target
  
  Sales confirmation-a13802KA.docx
- Size
  
  10KB
- MD5
  
  aa17844cf349edcb703a84874bf9b51f
- SHA1
  
  9c894354e8aac4c58f111c7405a3f92d93d3da4f
- SHA256
  
  e2f7f94897d3c542e882840cd25955f9bf9e1b1507955ee144bdf939adcce73e
- SHA512
  
  a3ac31637f009b6a717999a60dcc2c5ff032db791ef5c808654b728a7746f6353f3976ab44cb5bbc97e99e1ac87f57af8433076c23dc4c595d69768bcf2f9424
- SSDEEP
  
  192:ScIMmtPGT7G/bIwXOVOtlrV5SEzBC4vNq6sM63kp:SPXuT+xXOVOTbhlqHI
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2