agenttesla

General

Target

214314acb198f14903fb16538450fe69_JaffaCakes118
Size

274KB
Sample

240329-n1rtxagh38
MD5

214314acb198f14903fb16538450fe69
SHA1

d28b62d92aa73da2662f52a20ecb896fbf248806
SHA256

fa708dbd323666bef72779702e67ea18192727f8d881ed8cd295619b892e6f1b
SHA512

c6a578141238fc0ebeba108f4c325b4d6fa1d2ab37304281253e94f4d7927ebb22fab5bcd411688feed159f57bd5a2cbebcf0200f1e5d29b773392e9be4523b8
SSDEEP

6144:wBlL/cjLlGE+pbaB4HFr0l0nBE+3Vn/hNWX+qkP8ySQQe0O:Ce0Eibgoe0nZ3VnJc91O

Score

10^/10

Malware Config

Targets

- Target
  
  214314acb198f14903fb16538450fe69_JaffaCakes118
- Size
  
  274KB
- MD5
  
  214314acb198f14903fb16538450fe69
- SHA1
  
  d28b62d92aa73da2662f52a20ecb896fbf248806
- SHA256
  
  fa708dbd323666bef72779702e67ea18192727f8d881ed8cd295619b892e6f1b
- SHA512
  
  c6a578141238fc0ebeba108f4c325b4d6fa1d2ab37304281253e94f4d7927ebb22fab5bcd411688feed159f57bd5a2cbebcf0200f1e5d29b773392e9be4523b8
- SSDEEP
  
  6144:wBlL/cjLlGE+pbaB4HFr0l0nBE+3Vn/hNWX+qkP8ySQQe0O:Ce0Eibgoe0nZ3VnJc91O
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/oaolxjpjc.dll
- Size
  
  26KB
- MD5
  
  fb556c16d4ab04252f71268c986a5c43
- SHA1
  
  5d8857c0fa4543642286072337af96d8374494a9
- SHA256
  
  7c818c689d9194c90a1ecdd7838cd59ff216971cad20caf8e091d9fa48c7f3fe
- SHA512
  
  adbfaf25b5937b934dc920436492faab186f0d5a64a57cb027da88a2c9fb4c8b65740713ff232400a908729ae4a48360a2ba79cce86237b9a79d2a1d840d7fc6
- SSDEEP
  
  384:c7QyMXLM36Y6rHgIM16z5o8r3MuCjswdAKkmwX:cEBLCUDk165BmJdAKkP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4