agenttesla

General

Target

5bd009ecc08c72c1d670a8aeaf2b3c4263edb9293465f893dd3768ab3ea0ff24.rar
Size

686KB
Sample

240523-r3yxsaeg59
MD5

cfb6de0d0013fc0a63b12664d69bcd16
SHA1

26d7f8c03e5298bcd53b0552353c6d914bec894a
SHA256

5bd009ecc08c72c1d670a8aeaf2b3c4263edb9293465f893dd3768ab3ea0ff24
SHA512

559c881ce00477a8029816471c6381f7e0b65309248aff2a405e1e578133b4db05994842fa8048203d4c33753906aa4ddce2fb916a8f03b67b8b44e1d73ef859
SSDEEP

12288:23e6XINpzkgmewejFWcw4rqYC6MIxUK/SjKpFdiafUcimTgDknNg2:g1XIN5kgmescdrqh6v+uYKNUcZgon+2

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bonnyriggdentalsurgery.com.au
Port:
587
Username:
[email protected]
Password:
Sages101*
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.bonnyriggdentalsurgery.com.au
Port:
587
Username:
[email protected]
Password:
Sages101*

Targets

- Target
  
  Swift scan.exe
- Size
  
  844KB
- MD5
  
  2b09b0e829ae8e3baf44ea7597e9d83a
- SHA1
  
  23e22129c79e41808ba77bf99a1bf8e77d8e5182
- SHA256
  
  167a7a33c321ff9bf91a313c19edb14c195c34662c465560a868e6d2d8f214ad
- SHA512
  
  82a3e5a413fd985ab0e868fba65312429a5686fa49f91d19ca670bf85988f3548205bd7b6ab69c6f0080555726a83bbc309b57917004c7bb7957f94235da9a4e
- SSDEEP
  
  12288:SJx504bFtx504bFWxETdmtCJET9OziEECUBOwHOGnaOjiobasXd37G:gw4bjw4bnpRzMOQbTN7
Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2