agenttesla

General

Target

83f3e50853a0cf0ad1db138440032b41e274ce48bba2f9300216778815ba0f70
Size

616KB
Sample

240727-blzjzszfng
MD5

64e18a3d60a0715aa6448ad736fc3c39
SHA1

b90b8ab4ef894d7c15413d1258262b27a38294e6
SHA256

83f3e50853a0cf0ad1db138440032b41e274ce48bba2f9300216778815ba0f70
SHA512

414ad9c6ed72925e9124d8a7fb06af897061336eefb97093c573225a315391b503312b0b089c1831d8a9824c3f48febaaa35a5f3f630a86e31ff1bc26697deef
SSDEEP

12288:xHalde9+XRrbC2iI+lFBrTkHMX8H66eGRV9SJRjNP4EG0cfn:pabpr22h+JXeHazwspCEo

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  83f3e50853a0cf0ad1db138440032b41e274ce48bba2f9300216778815ba0f70
- Size
  
  616KB
- MD5
  
  64e18a3d60a0715aa6448ad736fc3c39
- SHA1
  
  b90b8ab4ef894d7c15413d1258262b27a38294e6
- SHA256
  
  83f3e50853a0cf0ad1db138440032b41e274ce48bba2f9300216778815ba0f70
- SHA512
  
  414ad9c6ed72925e9124d8a7fb06af897061336eefb97093c573225a315391b503312b0b089c1831d8a9824c3f48febaaa35a5f3f630a86e31ff1bc26697deef
- SSDEEP
  
  12288:xHalde9+XRrbC2iI+lFBrTkHMX8H66eGRV9SJRjNP4EG0cfn:pabpr22h+JXeHazwspCEo
Score

10^/10

discovery execution agenttesla credential_access keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2