agenttesla

General

Target

33647cf1d7ba05386d44a608a94979925883f8e8c0e5f63b3f2e7ffdc7380461.exe
Size

656KB
Sample

240727-bl91qaxcpq
MD5

3d33cbde84d0a1197ec0d459d634473e
SHA1

abd0074c5b2eed8fbab4d30443ceac4b403ad09d
SHA256

33647cf1d7ba05386d44a608a94979925883f8e8c0e5f63b3f2e7ffdc7380461
SHA512

36f31309dddf020fd9fee7c44d8847924c4f8a9306a7f04dfa15fd2b73645c982f98d4b7a616b2b31d4b3c14510f2858608beda519eb8475780b544a4eedcea1
SSDEEP

12288:6ChcU7r3FL0YtcCCvLLgov4CnDUOt7TDM2DG0oSb3fqEVzXfmhujHeis3c:Jco3FYYtajLX4stTA2DGbSeEUh+ei8c

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.jlahuachem.com
Port:
587
Username:
[email protected]
Password:
eGbB!FT9
Email To:
[email protected]

Targets

- Target
  
  33647cf1d7ba05386d44a608a94979925883f8e8c0e5f63b3f2e7ffdc7380461.exe
- Size
  
  656KB
- MD5
  
  3d33cbde84d0a1197ec0d459d634473e
- SHA1
  
  abd0074c5b2eed8fbab4d30443ceac4b403ad09d
- SHA256
  
  33647cf1d7ba05386d44a608a94979925883f8e8c0e5f63b3f2e7ffdc7380461
- SHA512
  
  36f31309dddf020fd9fee7c44d8847924c4f8a9306a7f04dfa15fd2b73645c982f98d4b7a616b2b31d4b3c14510f2858608beda519eb8475780b544a4eedcea1
- SSDEEP
  
  12288:6ChcU7r3FL0YtcCCvLLgov4CnDUOt7TDM2DG0oSb3fqEVzXfmhujHeis3c:Jco3FYYtajLX4stTA2DGbSeEUh+ei8c
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2