agenttesla

General

Target

04fbf7a3ae45e1d51dd00724cd7291c4d0422f11028916d32c6e2b269656dee2
Size

2.5MB
Sample

240329-cbxhbaee7w
MD5

109a5972cdb1697c275c54d6b6aa1f61
SHA1

4b773325d02fc7862e64f0e8ceac5a826952d6ca
SHA256

04fbf7a3ae45e1d51dd00724cd7291c4d0422f11028916d32c6e2b269656dee2
SHA512

4e53b5bbbdeb573b124c0729638e338513ab70e4297010c5898be5fdb6037cb5061de5a79b9bbe997e9a794d0f4229e4c1b1a75d080057fde49c482978fac18d
SSDEEP

49152:v1x/8viD8UznAEk8Yof0kmvY/npZSlOiJH+npBCeCDU3ALHwAqlf39iya2QM2Zv0:Nx/F8Uzi8YoMkGYPpZSlO+HUBCeCDvLy

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6859606558:AAGx7fHrpBCN-CTqCzssxHyN25eAdEuJelI/

Targets

- Target
  
  04fbf7a3ae45e1d51dd00724cd7291c4d0422f11028916d32c6e2b269656dee2
- Size
  
  2.5MB
- MD5
  
  109a5972cdb1697c275c54d6b6aa1f61
- SHA1
  
  4b773325d02fc7862e64f0e8ceac5a826952d6ca
- SHA256
  
  04fbf7a3ae45e1d51dd00724cd7291c4d0422f11028916d32c6e2b269656dee2
- SHA512
  
  4e53b5bbbdeb573b124c0729638e338513ab70e4297010c5898be5fdb6037cb5061de5a79b9bbe997e9a794d0f4229e4c1b1a75d080057fde49c482978fac18d
- SSDEEP
  
  49152:v1x/8viD8UznAEk8Yof0kmvY/npZSlOiJH+npBCeCDU3ALHwAqlf39iya2QM2Zv0:Nx/F8Uzi8YoMkGYPpZSlO+HUBCeCDvLy
Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2