agenttesla

General

Target

d252b1e5d631254ac42e7dadab485984559dd16ff217f6ffc694ef235d6d58e9.r00
Size

628KB
Sample

240328-c4sptsdc6w
MD5

ebb1f3ce62c28eb763863eb46fb1004c
SHA1

396bcb38b2160cfb8fe0f5e188e6b025e45502a7
SHA256

d252b1e5d631254ac42e7dadab485984559dd16ff217f6ffc694ef235d6d58e9
SHA512

c8405a4ba2682ef487c26c16e9bbe5271cf9a2483be48a88526528dbae698183640a73cdecf7f7c6debb68d8d5c1899de2007055a491ca05b809717a9d4020e1
SSDEEP

12288:3JHZN6OiZTg/n8gddyQuoUu21f9WMWyJPm90JbSzuM0YTLaXOU7Pu66ava56+O:J/6O5n84Y3fBrWCPm90JNM0IaXOcugvX

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sg2plcpnl0128.prod.sin2.secureserver.net
Port:
587
Username:
accounts@equityhyundai.com
Password:
oc27-JcbRAO~
Email To:
xqalloys@gmail.com

Targets

- Target
  
  RCP000004689 SWIFT COPY.exe
- Size
  
  658KB
- MD5
  
  288ca7008a4c4c5209c6ec3e140686bc
- SHA1
  
  70ce1b94aa00f963cf520b436c2d5559b7d44107
- SHA256
  
  15d2a43a0424b074f4e9f306f95bd04f9a3c33561b021364a8edaa78767c631c
- SHA512
  
  a7ce1d18fa745e0c1c55af0e3cdbb7c9b32ffb1eecb9f1075978c283e8b34edf83607711de93abed5293bb9e6143862a6980ce8d3dd72bcf084dfb9647a0fece
- SSDEEP
  
  12288:fH2iNlw0QKtgmz6wAAGCtp46wxdpXSiYFvaytWF7Mvs6gcGBWYTzqbC:v1Xhfz6aG8oMi7F7QuWY6G
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with SmartAssembly
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2