agenttesla

General

Target

fa4ba824a689d6d8bf6738b41311951b_JaffaCakes118
Size

311KB
Sample

240927-m7lqsszaqp
MD5

fa4ba824a689d6d8bf6738b41311951b
SHA1

31001aea6e517e6d02d586ae444e9318f9c1923b
SHA256

e609b0840d4e812a94c5955be5718583a4f589ad7dcc7e0893164d50bd000bd9
SHA512

3eb512a33113dc4c51123667fbfc1d2f4762280dcbdbaa4178ca51e9916177895f1561faba5d2149582b263f2fef56874459d194033ab09434fb4a31294f5aee
SSDEEP

6144:b8LxBBXsBdONpPvE3XpMHdlYP03IqiJURlHB6p55/2LRYSbRvpqG31pQ68PTqRI2:ysBdONpPvXe036JUnHB6p55p4D3TZU72

Score

10^/10

Malware Config

Targets

- Target
  
  fa4ba824a689d6d8bf6738b41311951b_JaffaCakes118
- Size
  
  311KB
- MD5
  
  fa4ba824a689d6d8bf6738b41311951b
- SHA1
  
  31001aea6e517e6d02d586ae444e9318f9c1923b
- SHA256
  
  e609b0840d4e812a94c5955be5718583a4f589ad7dcc7e0893164d50bd000bd9
- SHA512
  
  3eb512a33113dc4c51123667fbfc1d2f4762280dcbdbaa4178ca51e9916177895f1561faba5d2149582b263f2fef56874459d194033ab09434fb4a31294f5aee
- SSDEEP
  
  6144:b8LxBBXsBdONpPvE3XpMHdlYP03IqiJURlHB6p55/2LRYSbRvpqG31pQ68PTqRI2:ysBdONpPvXe036JUnHB6p55p4D3TZU72
Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ojbixxjlzk.dll
- Size
  
  30KB
- MD5
  
  f5480d6c032845135dff9ebf66c46d76
- SHA1
  
  e76f6c75aca31ab5c1ff4695b45ec49daef23256
- SHA256
  
  13f7ffcefcbba343a302edaf9ceccefcf6dbae294bb9a735869d9f3fc7c522dd
- SHA512
  
  5164a9c8c470308a17a82f39209ea734893c7f5ccbafe9fe67bc98bb70432f46dd5faad61ad6dd8da86a88d89eb6deefb5d626abffd4ed8e8e72eba6c314d575
- SSDEEP
  
  768:5YH4sBQJDh7wN4Ce1UtpWOPO8P9MuVnu+OGTYgFD:5IBQJDKLPO8P9Pnu+OIh
Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4