agenttesla

General

Target
c52efb374c9ea3da1670bb05c39271fb9a1f5c8d3d7444a6b167f0ef2b962422.exe
Size 705KB
Sample240601-b8q65aed29
SHA256 c52efb374c9ea3da1670bb05c39271fb9a1f5c8d3d7444a6b167f0ef2b962422
MD5 e8555ba2eb0ebc66a017aa7f043d88bb
SHA1 1b1f2e7764f9549fac5c3dd88aedb616b762d889
SHA512 ddc14c3a29d5820654006cceb3054bf36e45981c259801cb91e779cd07398ef6731ffd9b5ea99e400a143371059d0816a12cf80f45b6f21366f47e7c0ef16cf4
SSDEEP 12288:12iNjJS4VGAIzkJZKCIQ/DzFwAdh0jX5ffVdOXiL9V8JgGHWV0/TrL6+RQrBx0C:11XScGAIzkLI+DeAMb5ffVdT8ZT/zCHD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.kenvue.cam
Port
21
Username
[email protected]
Password
f}ix4QQMqoW1

Targets

- Target
  c52efb374c9ea3da1670bb05c39271fb9a1f5c8d3d7444a6b167f0ef2b962422.exe
- Size 705KB
- SHA256 c52efb374c9ea3da1670bb05c39271fb9a1f5c8d3d7444a6b167f0ef2b962422
- MD5 e8555ba2eb0ebc66a017aa7f043d88bb
- SHA1 1b1f2e7764f9549fac5c3dd88aedb616b762d889
- SHA512 ddc14c3a29d5820654006cceb3054bf36e45981c259801cb91e779cd07398ef6731ffd9b5ea99e400a143371059d0816a12cf80f45b6f21366f47e7c0ef16cf4
- SSDEEP 12288:12iNjJS4VGAIzkJZKCIQ/DzFwAdh0jX5ffVdOXiL9V8JgGHWV0/TrL6+RQrBx0C:11XScGAIzkLI+DeAMb5ffVdT8ZT/zCHD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2