agenttesla

General

Target

Overdue Statement of Account_1.docx.doc
Size

10KB
Sample

230420-jptf5sgd66
MD5

397c47ede0b01a7145478c1c1ebfecad
SHA1

2f8398ddc426bcbaac364e6339b77b8e807c8fa4
SHA256

c14068b312c53040f23e40aca6a6251d2330b1ec6874061b50ebb7e6800fda29
SHA512

7eed78e77302ca07dca6926bf1deb2a0c0630d749811a1fc3d45e19aefb88b0ccb953a3e3782cb43901dc72bda73e8b5e9dd466a2421d5a16c6fb08a51bd94af
SSDEEP

192:ScIMmtPGT7G/bIwXOVORtKz5SEzBC4vNq6sM63SR:SPXuT+xXOVOSdhlqH2

Score

10^/10

Malware Config

Extracted

Rule

Microsoft Office WebSettings Relationship

C2

http://%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%22IIOOOWOEOEOEOEOEOEOISISODOEOEOEOODOOOOOOWWOWOQQQOWOWOWOWOIIIDIIFIFIWOEOEOEOIFIDIFODFI@1806682825/e/%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc

Targets

- Target
  
  Overdue Statement of Account_1.docx.doc
- Size
  
  10KB
- MD5
  
  397c47ede0b01a7145478c1c1ebfecad
- SHA1
  
  2f8398ddc426bcbaac364e6339b77b8e807c8fa4
- SHA256
  
  c14068b312c53040f23e40aca6a6251d2330b1ec6874061b50ebb7e6800fda29
- SHA512
  
  7eed78e77302ca07dca6926bf1deb2a0c0630d749811a1fc3d45e19aefb88b0ccb953a3e3782cb43901dc72bda73e8b5e9dd466a2421d5a16c6fb08a51bd94af
- SSDEEP
  
  192:ScIMmtPGT7G/bIwXOVORtKz5SEzBC4vNq6sM63SR:SPXuT+xXOVOSdhlqH2
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2