agenttesla

General

Target

deef1ff08fc431471ae1e919fe20e196d0c86c1ec544df11b947a7a465c2a045
Size

678KB
Sample

240727-bl1r2sxcmp
MD5

27ffe64e51fb8d8f6b280da14b99e516
SHA1

2371dabc49bdb6b4daa128f694d5608b314a9d14
SHA256

deef1ff08fc431471ae1e919fe20e196d0c86c1ec544df11b947a7a465c2a045
SHA512

8f32d9d63b11437a74c9a9f50a128bbfe6e01faa1bccda0bc6cbe655ec9344206587baef8827c3b1acd48cc12ec6a01c2aeba6d4862b1dc590f51677680261c4
SSDEEP

12288:OHalde9+XRrbC2iI+lFBrTkHMX8H66eGRV9SJRjNP4EG0cfn:4abpr22h+JXeHazwspCEo

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$

Targets

- Target
  
  Purchase Order #880115.pdf.exe
- Size
  
  616KB
- MD5
  
  64e18a3d60a0715aa6448ad736fc3c39
- SHA1
  
  b90b8ab4ef894d7c15413d1258262b27a38294e6
- SHA256
  
  83f3e50853a0cf0ad1db138440032b41e274ce48bba2f9300216778815ba0f70
- SHA512
  
  414ad9c6ed72925e9124d8a7fb06af897061336eefb97093c573225a315391b503312b0b089c1831d8a9824c3f48febaaa35a5f3f630a86e31ff1bc26697deef
- SSDEEP
  
  12288:xHalde9+XRrbC2iI+lFBrTkHMX8H66eGRV9SJRjNP4EG0cfn:pabpr22h+JXeHazwspCEo
Score

10^/10

agenttesla credential_access discovery execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2