agenttesla

General

Target

f7a0d860cb114e0734126c11f13e01b106d79fbd060eae0e3f511147cf31a8fa
Size

769KB
Sample

240522-bjcmfafg3s
MD5

4b200343e582bc6991d423d49f3eeeec
SHA1

e05f93451d2426822ab16b7272537efa8ee7812a
SHA256

f7a0d860cb114e0734126c11f13e01b106d79fbd060eae0e3f511147cf31a8fa
SHA512

5810fd6c1e52b45c75d33b5a0ae8c7c61831b9400af2f421f914f26132d13191432ed57b03f2134d7b98590ac921456493166406ebcf0a473c635b52ce08a1ef
SSDEEP

24576:GO26bOEuibUxXW6bsSxAs2SlhVz/M/BRls+WGXsBk5MJ:GO26bnuibUXwCllhFk/Lls+WibMJ

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Password: )NYyffR0
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Password: )NYyffR0

Targets

- Target
  
  Swift Copy Of Pending payment.exe
- Size
  
  896KB
- MD5
  
  90e79f831e49e4a1dd217e924901439d
- SHA1
  
  691db5a918bce1037706007d116c377edeb949e1
- SHA256
  
  1cc4e1cd2856bfacad4276b81fcbabd357e3b870d0ea553598bb5886511e6580
- SHA512
  
  58f444d94637d8bd982c151062ded998d31f6adbae9782bfe967259b665bf227fc851b74294e88f11d4459c568fe6b451df037ffaad1fad2dbaf0170b4d41d9f
- SSDEEP
  
  24576:rw4bjw4bbobwU5bw9hVFp6x1Rl0+rusJUB7:rw4bjw4bcEiU9hfYxfl0+rL4
Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2