agenttesla

General

Target

dda04090f191390ed41405c69e3bcd6d26270514ce3d0d9269f08e8365ae458c
Size

725KB
Sample

240523-bp3e2sgc5t
MD5

dccff44589161c5f4eeca38db7a20b9b
SHA1

650518208c762663a0d35041dd85cb84808d39ab
SHA256

dda04090f191390ed41405c69e3bcd6d26270514ce3d0d9269f08e8365ae458c
SHA512

95ab40feba08ba18efde1f4323664f0974b07575764f131ff28768f77ff2a5db3f38894f9e4c821ef4d89493ae954596936b53aa437149159aedbb658df48354
SSDEEP

12288:reD5WNjpkskxRDqaCgqRR5F6HkkoFef0sonfzsomBF7q54e/+2ygAKV7/jSWiY6L:re5WNjpkskxRDqaCgqRR+zqfzsd7aQWu

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.jeepcommerce.rs
Port:
21
Username:
[email protected]
Password:
bL&q9JeQmSE)

Targets

- Target
  
  dda04090f191390ed41405c69e3bcd6d26270514ce3d0d9269f08e8365ae458c
- Size
  
  725KB
- MD5
  
  dccff44589161c5f4eeca38db7a20b9b
- SHA1
  
  650518208c762663a0d35041dd85cb84808d39ab
- SHA256
  
  dda04090f191390ed41405c69e3bcd6d26270514ce3d0d9269f08e8365ae458c
- SHA512
  
  95ab40feba08ba18efde1f4323664f0974b07575764f131ff28768f77ff2a5db3f38894f9e4c821ef4d89493ae954596936b53aa437149159aedbb658df48354
- SSDEEP
  
  12288:reD5WNjpkskxRDqaCgqRR5F6HkkoFef0sonfzsomBF7q54e/+2ygAKV7/jSWiY6L:re5WNjpkskxRDqaCgqRR+zqfzsd7aQWu
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2