agenttesla

General

Target

938a507f1786d7badcc95dca38a1d9bdb78984b051a68a7fd70a1b872b36a2b2.exe
Size

1.3MB
Sample

240522-ce738agg64
MD5

7741e296fc7876e2cf35e44ba4264f47
SHA1

265bb706ee04a4d3b6f23c87873bc7d5202c0de9
SHA256

938a507f1786d7badcc95dca38a1d9bdb78984b051a68a7fd70a1b872b36a2b2
SHA512

1caa387ded8ec1431cceba2def2abfdf53883fdb2c300d8a64de726f35e0a28f0036c29f0f2d894fcdcff6f6bcb6f827124ca6ca7419fa24d212d84ec5d21ffc
SSDEEP

24576:99Q0lIVTRJRqhx+pF/GMvtfc+DBy/U77VaaG8uosbrDqa1VHWTcSdmWDxbLn/ohK:LQ0lsRzeMp8MtftD4M77YoOrDX1l2xb3

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.biotem.com.tr
Port:
587
Username:
[email protected]
Password:
alesta.,alesta.,
Email To:
[email protected]

Targets

- Target
  
  938a507f1786d7badcc95dca38a1d9bdb78984b051a68a7fd70a1b872b36a2b2.exe
- Size
  
  1.3MB
- MD5
  
  7741e296fc7876e2cf35e44ba4264f47
- SHA1
  
  265bb706ee04a4d3b6f23c87873bc7d5202c0de9
- SHA256
  
  938a507f1786d7badcc95dca38a1d9bdb78984b051a68a7fd70a1b872b36a2b2
- SHA512
  
  1caa387ded8ec1431cceba2def2abfdf53883fdb2c300d8a64de726f35e0a28f0036c29f0f2d894fcdcff6f6bcb6f827124ca6ca7419fa24d212d84ec5d21ffc
- SSDEEP
  
  24576:99Q0lIVTRJRqhx+pF/GMvtfc+DBy/U77VaaG8uosbrDqa1VHWTcSdmWDxbLn/ohK:LQ0lsRzeMp8MtftD4M77YoOrDX1l2xb3
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  b8992e497d57001ddf100f9c397fcef5
- SHA1
  
  e26ddf101a2ec5027975d2909306457c6f61cfbd
- SHA256
  
  98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
- SHA512
  
  8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
- SSDEEP
  
  192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
Score

3^/10
behavioral3 behavioral4