agenttesla

General

Target

11ff90a33d73be660d1408cf99f48baa9dbaf0d15572848a7a024aab03973476.exe
Size

595KB
Sample

240829-sbxq3szbkm
MD5

404b3e8655b581497ea6d1f394a5d27d
SHA1

8c706938bc43dd1c4678c4879f4dc51dad9e6431
SHA256

11ff90a33d73be660d1408cf99f48baa9dbaf0d15572848a7a024aab03973476
SHA512

7f135fc396cc280ef7454aaa785c1a570bf6b285b7eae70ce0d26cc8a477e024488884f5ca5d7e869917950cb6440b1bcd916069c859f28c355b48b44cfb50e1
SSDEEP

6144:aEpn+8kGzHlXoB9z2VloojvZNjuorHIpDFlSEf4H444l:9hHlXoBMVl8FR4H444l

Score

10^/10

Malware Config

Targets

- Target
  
  11ff90a33d73be660d1408cf99f48baa9dbaf0d15572848a7a024aab03973476.exe
- Size
  
  595KB
- MD5
  
  404b3e8655b581497ea6d1f394a5d27d
- SHA1
  
  8c706938bc43dd1c4678c4879f4dc51dad9e6431
- SHA256
  
  11ff90a33d73be660d1408cf99f48baa9dbaf0d15572848a7a024aab03973476
- SHA512
  
  7f135fc396cc280ef7454aaa785c1a570bf6b285b7eae70ce0d26cc8a477e024488884f5ca5d7e869917950cb6440b1bcd916069c859f28c355b48b44cfb50e1
- SSDEEP
  
  6144:aEpn+8kGzHlXoB9z2VloojvZNjuorHIpDFlSEf4H444l:9hHlXoBMVl8FR4H444l
Score

10^/10

agenttesla credential_access keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2