agenttesla

General

Target

22052024123122052024PURCHASEORDERPO2RU2024.pdf.gz
Size

631KB
Sample

240522-w322nabh8x
MD5

a3e6b27f2cd0a05e66fa535bad256be7
SHA1

eb50ebbd793d29c409b5864aaf7641f7f9ab8825
SHA256

4a5a55f3ada290496dbae9ad59f621b75c85923830580fc98d79d35a6ee7c6c0
SHA512

a46f146f316a4a5721d4dc95b4c1c25497dc4976f91d50a7b83b57732f416a8d1a6945f726a68884a2fb79f6812f9c08540106412522c3acd0b3ffb516148f4b
SSDEEP

12288:dI8sRFdo33iBIuC1iobqqv4LRLWORHyBieNvXR1eKy9+tUHGIOH:0BrCBELMoy8eh2t7H2H

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.alfainterplast.com.ua
Port:
587
Username:
[email protected]
Password:
pay2024password$$
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.alfainterplast.com.ua
Port:
587
Username:
[email protected]
Password:
pay2024password$$

Targets

- Target
  
  PURCHASE ORDERPO2RU2024.pdf.exe
- Size
  
  655KB
- MD5
  
  0218ec5f4de9dc0121ed37aa6fa29955
- SHA1
  
  f27dd6706c8ff4fee9f44014c678a39051a07b7f
- SHA256
  
  63dc3769ba6c3bfb7c98266782f767689ec924d22c83d707f46a2166899463fa
- SHA512
  
  8e2399fd27d811ea093bd63a8adee2099d4f32d2235804304405dedfcd32c5042388de0cbd1d7e3c19bc9ca547634293a5ba59b0bafbed4218b362ac4f00deb3
- SSDEEP
  
  12288:Ucjmzi8LkpEav2CIqkV3cPSzbKohtG6dyh7tl5sitFQsIlFPlC37tMnpkaqJ:tS2jEr1VV3cP8bKgG6IZl5BFIlFPc3p7
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2