agenttesla

General

Target

f4d7f6d4f6a5510d859acae3c90808d26932cf5eaa8f30e1c7badea92940b8ff
Size

614KB
Sample

240727-bl2pcaxcnj
MD5

37a9ba1e35e53a06fbce60ec5bb45217
SHA1

a36aadf48ec9e181538a46c97eb86b2844e40284
SHA256

f4d7f6d4f6a5510d859acae3c90808d26932cf5eaa8f30e1c7badea92940b8ff
SHA512

da46429f413bdec53deaa0ea88cf9a76fe4ba68017cb42ad79fe55b19a5a8b031d0a2c4457a8c7517a5830579013c46849928f464430532ee480d4e8c0643c07
SSDEEP

12288:uF3ag4gbw0mOW/UImTt7slGZVWL9OwSsiA7efBOvAbUjgRB/:Sag4mgOW/xmTtlVIafBKAb7D

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.normagroup.com.tr
Port:
21
Username:
[email protected]
Password:
Qb.X[.j.Yfm[

Extracted

Credentials

Protocol: ftp
Host:
ftp.normagroup.com.tr
Port:
21
Username:
[email protected]
Password:
Qb.X[.j.Yfm[

Targets

- Target
  
  f4d7f6d4f6a5510d859acae3c90808d26932cf5eaa8f30e1c7badea92940b8ff
- Size
  
  614KB
- MD5
  
  37a9ba1e35e53a06fbce60ec5bb45217
- SHA1
  
  a36aadf48ec9e181538a46c97eb86b2844e40284
- SHA256
  
  f4d7f6d4f6a5510d859acae3c90808d26932cf5eaa8f30e1c7badea92940b8ff
- SHA512
  
  da46429f413bdec53deaa0ea88cf9a76fe4ba68017cb42ad79fe55b19a5a8b031d0a2c4457a8c7517a5830579013c46849928f464430532ee480d4e8c0643c07
- SSDEEP
  
  12288:uF3ag4gbw0mOW/UImTt7slGZVWL9OwSsiA7efBOvAbUjgRB/:Sag4mgOW/xmTtlVIafBKAb7D
Score

10^/10

agenttesla credential_access discovery execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2