agenttesla

General

Target
3e9c1ebae528d18117474a40600829255b9bb82b6a91a1174f29595f701b04c6.exe
Size 1.2MB
Sample241102-epkrsayflb
SHA256 3e9c1ebae528d18117474a40600829255b9bb82b6a91a1174f29595f701b04c6
MD5 c8425676238228d1113a7ec5f2def5b8
SHA1 e65b447b52f61dca39f6a2fcf06f772f98289f12
SHA512 83b070b7c90a6a203e58732f92f304a094af9c53c1c8fb36280c402c911a3a3b1b7c3337afdf4f344207a416e7abf451e361ed1875635af979e3701b17d33f82
SSDEEP 24576:y4nhDoAFAImWmC4m6eI0uVhBoBNFy0oy3sZNXLGQ7WczkxFnfbP9U:y+hkxTlwVI02Y59TaNXKQKczgy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.mbarieservicesltd.com
Port
587
Username
[email protected]
Password
*o9H+18Q4%;M
Email to
[email protected]

Targets

- Target
  3e9c1ebae528d18117474a40600829255b9bb82b6a91a1174f29595f701b04c6.exe
- Size 1.2MB
- SHA256 3e9c1ebae528d18117474a40600829255b9bb82b6a91a1174f29595f701b04c6
- MD5 c8425676238228d1113a7ec5f2def5b8
- SHA1 e65b447b52f61dca39f6a2fcf06f772f98289f12
- SHA512 83b070b7c90a6a203e58732f92f304a094af9c53c1c8fb36280c402c911a3a3b1b7c3337afdf4f344207a416e7abf451e361ed1875635af979e3701b17d33f82
- SSDEEP 24576:y4nhDoAFAImWmC4m6eI0uVhBoBNFy0oy3sZNXLGQ7WczkxFnfbP9U:y+hkxTlwVI02Y59TaNXKQKczgy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla guloader collection discovery downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
- MD5 d6f54d2cefdf58836805796f55bfc846
- SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
- SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
- SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4