agenttesla

General

Target

d18e67f33e7815cac0619e0fd46d67be7501afda61250566e26c7d8d0dc6ed19.doc
Size

163KB
Sample

240424-cceznaea4z
MD5

62d7c3be479caa7b2b25b48dd973ffc1
SHA1

13f645f34ef3a6317d4c293ac3094b2e147264ea
SHA256

d18e67f33e7815cac0619e0fd46d67be7501afda61250566e26c7d8d0dc6ed19
SHA512

88bc21954829a092515b0ad3cfded196d382ee58562bbc01a3a914219924e7a0d8273de34fbffed8f38d94744c1343c30e3d6d5529efc75f8a22bc4ca2908534
SSDEEP

768:TwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjG+rHMHrYsSWz0lUTSpE:TwAlRkwAlRkwAlRpEHMHr8W4rE

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
28#75@ts76#V1F8h
Email To:
[email protected]

Targets

- Target
  
  d18e67f33e7815cac0619e0fd46d67be7501afda61250566e26c7d8d0dc6ed19.doc
- Size
  
  163KB
- MD5
  
  62d7c3be479caa7b2b25b48dd973ffc1
- SHA1
  
  13f645f34ef3a6317d4c293ac3094b2e147264ea
- SHA256
  
  d18e67f33e7815cac0619e0fd46d67be7501afda61250566e26c7d8d0dc6ed19
- SHA512
  
  88bc21954829a092515b0ad3cfded196d382ee58562bbc01a3a914219924e7a0d8273de34fbffed8f38d94744c1343c30e3d6d5529efc75f8a22bc4ca2908534
- SSDEEP
  
  768:TwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjG+rHMHrYsSWz0lUTSpE:TwAlRkwAlRkwAlRpEHMHr8W4rE
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2