agenttesla

General

Target

8b739e545fc95b979031b1d173680e40804cdfae954553daad04f865571072a5.zip
Size

641KB
Sample

240402-mm98nafb9x
MD5

7747e65ac15e89119de8e5ab56be4cef
SHA1

cc60f313a9a9b2da8a42ae0b055bd5f62da3a6b6
SHA256

525737c17d568c051b5aa45ba5124de786524cf59e3aeec5f4d6b51803f1620d
SHA512

9d4f92bd5b1f6f7b7ab1a096c2a54748fbf4cd2b769bc1db234f811ff05ca9319bddf5be09a49df447190658bf74934ab7d660e0f5eae8258f55d6d3c680f4be
SSDEEP

12288:kfIulBq1ti4LS07sWkGsZ5xEpOr82fyYrBr0SRggvq+cyBC3F3FuwMFtpoiH:xHLSestvZ5x+Y82q2rIMBC3F1uwMFrH

Score

10^/10

Malware Config

Targets

- Target
  
  49136 E2K 610622871149136 E2K 6106228711.exe
- Size
  
  804KB
- MD5
  
  e8b61b099af93918a7d59477334471e0
- SHA1
  
  a2ce7a730e96bf6c8f9cd512993fd67cf0c10767
- SHA256
  
  e7456c57dba442a7e63f2bd45ff5be6c8168f2fcfd15c5e405536fb3bb212dcb
- SHA512
  
  30b93418d244b71718a7fbf6683c27ac4bc799338f67d915367cb7cb5b93dab661b5b9071f49e055e9701d721ef3e788a0632adc062ecd32d1ffe225712bd855
- SSDEEP
  
  12288:IYgBDMwdNEb40oLhLr1+vuYdCllN9cnUstwbvhz58lZNKXGLfR:IYgB7mINL/vbDci1p2d
Score

10^/10

persistence agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  kigtiqm.exe
- Size
  
  872KB
- MD5
  
  c56b5f0201a3b3de53e561fe76912bfd
- SHA1
  
  2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA256
  
  237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- SHA512
  
  195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP
  
  12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Score

3^/10
behavioral3 behavioral4
- Target
  
  xmnxoix.au3
- Size
  
  4KB
- MD5
  
  0d013f6baac0a09a1fb8e14217317503
- SHA1
  
  453fba3488930e98d075946a31e5455b84eed5ba
- SHA256
  
  0a78523b6163a8372ba64e5cc275d68f6582b7ca3a93e3163ad96251cc788d83
- SHA512
  
  05032c4bbdc56992768a87ebaa9a9f43cb9092df401bb61a20673c1bec3a1f3fe4ee7c55c0572ceac9d862538ac765d0e0577cb63424c5edf137f7948feb8ced
- SSDEEP
  
  96:8Qj+oh+0ddn/qEMA98SM/26Ai9qFnOnYPUub2:l+oh+0ddn/KA98//26Ao0Oyry
Score

1^/10
behavioral5 behavioral6