agenttesla

General

Target

f875e1997ef11eaf99dcb904fc36e95c917221519eed6e953573351c401abfa6
Size

865KB
Sample

240523-bqaresgc61
MD5

335d7670cd3baf2eb351af9e91c525f8
SHA1

09d29d313bd687e8aff1892db673a3fc47a5af45
SHA256

f875e1997ef11eaf99dcb904fc36e95c917221519eed6e953573351c401abfa6
SHA512

f81eddece62dbad05ca09bd7f2bc51004fe8205a600628963bcbe270a0280ee627f12fcaf030794b54bbb8c4fb0dac8256cb7c09b69597b839d9f619340cc862
SSDEEP

24576:jBVbtgi9W7utV+PNG/DY7i1ZOdut3iuv7lo:jBVbtTgVVCbM+3/lo

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.klptruck.hu
Port:
21
Username:
[email protected]
Password:
kCu}[Z7z+)S[

Extracted

Credentials

Protocol: ftp
Host:
ftp.klptruck.hu
Port:
21
Username:
[email protected]
Password:
kCu}[Z7z+)S[

Targets

- Target
  
  f875e1997ef11eaf99dcb904fc36e95c917221519eed6e953573351c401abfa6
- Size
  
  865KB
- MD5
  
  335d7670cd3baf2eb351af9e91c525f8
- SHA1
  
  09d29d313bd687e8aff1892db673a3fc47a5af45
- SHA256
  
  f875e1997ef11eaf99dcb904fc36e95c917221519eed6e953573351c401abfa6
- SHA512
  
  f81eddece62dbad05ca09bd7f2bc51004fe8205a600628963bcbe270a0280ee627f12fcaf030794b54bbb8c4fb0dac8256cb7c09b69597b839d9f619340cc862
- SSDEEP
  
  24576:jBVbtgi9W7utV+PNG/DY7i1ZOdut3iuv7lo:jBVbtTgVVCbM+3/lo
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2