agenttesla

General

Target

e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118
Size

345KB
Sample

240914-qvecqswepq
MD5

e049bf2e95cfd9354cd04da57dc33e0d
SHA1

e5b896193a4bcfd10723dd914e2f19fd693df9b3
SHA256

2122beff06c9c868008da7f8d5659f4866b5696a809abf8c48b231db6e6a690f
SHA512

f01d1c90cd261c21a7536cc907e9bf3d0a6e3b45f6f60cc18da9350f687116d404161c1d5ead05bcad30da8b2f0c94fc3068389db6820be16a06fbf8cad10dcd
SSDEEP

6144:011QE6KflZF3TcH76K9Wwj1JJUkOOeaGO+/5cX52J2w:sFrITWwBJJfOOfGB/Q2Jr

Score

10^/10

Malware Config

Targets

- Target
  
  e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118
- Size
  
  345KB
- MD5
  
  e049bf2e95cfd9354cd04da57dc33e0d
- SHA1
  
  e5b896193a4bcfd10723dd914e2f19fd693df9b3
- SHA256
  
  2122beff06c9c868008da7f8d5659f4866b5696a809abf8c48b231db6e6a690f
- SHA512
  
  f01d1c90cd261c21a7536cc907e9bf3d0a6e3b45f6f60cc18da9350f687116d404161c1d5ead05bcad30da8b2f0c94fc3068389db6820be16a06fbf8cad10dcd
- SSDEEP
  
  6144:011QE6KflZF3TcH76K9Wwj1JJUkOOeaGO+/5cX52J2w:sFrITWwBJJfOOfGB/Q2Jr
Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  tdh.dll
- Size
  
  20KB
- MD5
  
  1dafb2cf34f35d5814c11c4c7c97aad8
- SHA1
  
  3f49bcb442c672bda015eebc1e1e6ca8584b2c01
- SHA256
  
  a6ab79699435b6f5879e540cb754be7a637e7b878b3decd87a6a9445f81ae6d6
- SHA512
  
  c8c0b1529aae25a95b053f82724ac1b60e4a1ab3493187691aab8a46c93414379222c06de238b7f351bd062ab7aa8a03e5d5b2122a0d9b1b30712501b6780365
- SSDEEP
  
  384:yUd16SbVPzBmM6I/5qCXRw14yIngycpX6KsJndf+PXwMqdDrCHzKmO:aS0IxNRQIgyYXHkndWoM1TKv
Score

3^/10

discovery
behavioral5 behavioral6