agenttesla

General

Target
DATASHEET_Quote Required.iso
Size 426KB
Sample240502-qws8aacb26
SHA256 b0222d4e56f9fcd1e24ff96b509da67357e2e899d21c5088a0800aff9df18202
MD5 2e57e9d369cc5797ea7b345f1eeb22af
SHA1 44e52c1dde5dc60733dbfc01bc1d59f33a05fbe8
SHA512 c92b608e5375d0ee3e2bb87268f2bff33aa874ee3cda58a711ad06714c8a243c78b5fe792b5745f7926324a8d2b7958a3b8b9517849b0fe9a94d61785919eabb
SSDEEP 6144:AcQ9zIITdbWCYoZjp2D210jNiIwUv5PGqJe+kmX/SZB3pH2ybSnYOD69Y7Q:wwCYsjpu210jNnlGqJolIyUYOu9Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.ru
Port
587
Username
[email protected]
Password
marcellinus360
Email to
[email protected]

Targets

- Target
  DATASHEET_Quote Required.exe
- Size 364KB
- SHA256 037afb04ecb79c472588e6f1b3571abb8903af2fc86f1a8ca2e2acb63c14335b
- MD5 25727be97a9ff477eaf9f5ede2517d4a
- SHA1 66de55b95e1f19b9c626e35126e9c6dbac8680b0
- SHA512 f1ecad4f78ddab2d5dcd0ba863f97b17e68e25f6369b0532cf12353f067beec6e358c9acdf82ed84eb7fba19acc55e7085369082757e8a6a18fa1b15e435015a
- SSDEEP 6144:BcQ9zIITdbWCYoZjp2D210jNiIwUv5PGqJe+kmX/SZB3pH2ybSnYOD69Y7Qh:BwCYsjpu210jNnlGqJolIyUYOu9YW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla guloader downloader keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
- MD5 6f5257c0b8c0ef4d440f4f4fce85fb1b
- SHA1 b6ac111dfb0d1fc75ad09c56bde7830232395785
- SHA512 a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
- SSDEEP 96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4