agenttesla

General

Target

47102ff84cc6cbe08eba69e78382e5d68c81ebde9c2467bc034e4e55980fa278
Size

695KB
Sample

240522-bqz2baga4y
MD5

72306b6fd5845f4d50d982de5e28652e
SHA1

81e86ad225318b0d796aab91216d5125952b4a1d
SHA256

47102ff84cc6cbe08eba69e78382e5d68c81ebde9c2467bc034e4e55980fa278
SHA512

9e4db09d7a691f1a6d30be2cd3c068e5e5685817e527c07118114c834faf12d1ecaaedaf7040ad36105b9435deaea71a42fa957e215f4b8bc90056ed17968fab
SSDEEP

12288:4iETpbqxGb9EJ8EU1OiRvB4RMUO24EoJw0ODnKwUYzsZ40ppsYGrqx5wWm:Ub+GRXY0qRMU6EoJbO+wUYzsHTG2vY

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.jeepcommerce.rs
Port:
21
Username:
[email protected]
Password:
s04.$S]nbXTq

Extracted

Credentials

Protocol: ftp
Host:
ftp.jeepcommerce.rs
Port:
21
Username:
[email protected]
Password:
s04.$S]nbXTq

Targets

- Target
  
  47102ff84cc6cbe08eba69e78382e5d68c81ebde9c2467bc034e4e55980fa278
- Size
  
  695KB
- MD5
  
  72306b6fd5845f4d50d982de5e28652e
- SHA1
  
  81e86ad225318b0d796aab91216d5125952b4a1d
- SHA256
  
  47102ff84cc6cbe08eba69e78382e5d68c81ebde9c2467bc034e4e55980fa278
- SHA512
  
  9e4db09d7a691f1a6d30be2cd3c068e5e5685817e527c07118114c834faf12d1ecaaedaf7040ad36105b9435deaea71a42fa957e215f4b8bc90056ed17968fab
- SSDEEP
  
  12288:4iETpbqxGb9EJ8EU1OiRvB4RMUO24EoJw0ODnKwUYzsZ40ppsYGrqx5wWm:Ub+GRXY0qRMU6EoJbO+wUYzsHTG2vY
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2