agenttesla

General

Target

dfe0333e43317bae44de641475b273ac7c5839d9cccfa3b7ddb726d5e224e476.exe
Size

618KB
Sample

240919-b9pppavdlq
MD5

d2c7cc884cbc08d8d05e232e8c65e598
SHA1

73a8e883f694647499e918f567705e6939fea5e7
SHA256

dfe0333e43317bae44de641475b273ac7c5839d9cccfa3b7ddb726d5e224e476
SHA512

f2a3627a1c8369fe3e948b73e9376b115a020e0d9019e83b65382e00d9fa4a9d436e59c7b27efdafb0dbeb5f9f3e51da681de3e90fb56354a91be8d5e08c2150
SSDEEP

12288:TPhc0gvLlx0hOyX4mH5lKNIWV7ri1akBkj9zRqB+/dI6cLkR:TPqvLIWIWdi9bs6S

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
aowapnzgtwgqowgt
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
aowapnzgtwgqowgt

Targets

- Target
  
  dfe0333e43317bae44de641475b273ac7c5839d9cccfa3b7ddb726d5e224e476.exe
- Size
  
  618KB
- MD5
  
  d2c7cc884cbc08d8d05e232e8c65e598
- SHA1
  
  73a8e883f694647499e918f567705e6939fea5e7
- SHA256
  
  dfe0333e43317bae44de641475b273ac7c5839d9cccfa3b7ddb726d5e224e476
- SHA512
  
  f2a3627a1c8369fe3e948b73e9376b115a020e0d9019e83b65382e00d9fa4a9d436e59c7b27efdafb0dbeb5f9f3e51da681de3e90fb56354a91be8d5e08c2150
- SSDEEP
  
  12288:TPhc0gvLlx0hOyX4mH5lKNIWV7ri1akBkj9zRqB+/dI6cLkR:TPqvLIWIWdi9bs6S
Score

10^/10

agenttesla credential_access discovery execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2