agenttesla

General

Target

276f9055909174b4cf05748f028a3f0cf9c33bc371200b1d0e9c366a1b92e003.rar
Size

547KB
Sample

240524-bg9jdsfh33
MD5

9c03ad5c78cb4fd7336e380bd842f2aa
SHA1

bcd1cc7e41daed5bb3e29d2509caf674d228cee2
SHA256

276f9055909174b4cf05748f028a3f0cf9c33bc371200b1d0e9c366a1b92e003
SHA512

eea725a53d788db2e414207525350d4deadeec753f9e287597ea7816f906362b73db80cc57479eb36924f1c66df36fa19af5db747c0f0f35f42e2d143ebacfe7
SSDEEP

12288:/7+yoJkZW4WYmuHQ+Q2mfbIcA119V/L9bSrbSvc0n/4E4Dq:T+vJkZQuHQpMcA9VjwQ4EP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mbarieservicesltd.com
Port:
587
Username:
[email protected]
Password:
*o9H+18Q4%;M
Email To:
[email protected]

Targets

- Target
  
  Quotation - 00645.exe
- Size
  
  811KB
- MD5
  
  42f4ad74b08ac8e44928083706bc422a
- SHA1
  
  6e7082c542a8a1ed54fa7287d163e64eba98ee4f
- SHA256
  
  ba38c374f40119a4acbdab2bc171043b87bae2d299b2628f2a02da87e851c97f
- SHA512
  
  a281a626525da1db4b166711e7cbc23e76ce7bcfaf9d8e5f550461b9b7016bd834961ee2824134334c20c011434c61b8b5a44d3e9e8d875c8380883f3adfafad
- SSDEEP
  
  12288:08ps2o+FgfSy9Sm9LrvwJhlfydchnczs04mIXeY14:08pHhdy9SBffjhcoZhV1
Score

10^/10

agenttesla collection execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2