agenttesla

General

Target

b3e5f5ab8bce7255ae77b681a6835167c82811db5e23ac2039787932c047c80b.zip
Size

619KB
Sample

240727-caaxxssdmg
MD5

d303db47003196094e79cd73f9b7c622
SHA1

3db2790f3020e40708b3167315857c683d1d8a41
SHA256

b3e5f5ab8bce7255ae77b681a6835167c82811db5e23ac2039787932c047c80b
SHA512

5fc20a49c43c9577a8e3759452e89bc2ef12042482865b60911f2c8b31059fddab4ba621ea4ec3e40ea57f1d762f125a91d0f0e02936c3c07e41fcd407e53f52
SSDEEP

12288:b5jVCfLb9Ej2Odrf16HlleVwYSJpWmZeSjEX4T3RUNlAsgKmU:b5jVw2yKL1yPoSjWmZex4zeNaE

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Password: )NYyffR0
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Password: )NYyffR0

Targets

- Target
  
  Payment for order - proof attached.exe
- Size
  
  728KB
- MD5
  
  a0f74c405b615828045a96d6eb464f77
- SHA1
  
  f2acdcf38ad5293435576cd3b5827d53cd5baeed
- SHA256
  
  cc9372baeb26eb7513415fd8da130f514a1add9d50f8f8e02f893b23c6a1a1f3
- SHA512
  
  5e9ede6635cce98e9e39cbe91db8b37f9dbef8e8988db8e41b7458246402b8621fb9e6d451919fd03de7292b7bd3975656f16510624929470c4e726dfdf863e9
- SSDEEP
  
  12288:jDfm5EmnV+fLDdCL2IBQ3GfV6JJH+HwY+JFWm1CSjEXuTJ6ts5EH+uM:j65EmnVUhCaSQ3yV0Rg+rWm1CxuNdEM
Score

10^/10

agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2