agenttesla

General

Target

f539c8892d58f4fd0f4cf209ad0486f31ec5b51debd315ef8fb278f0d1b26637.img
Size

1.9MB
Sample

241106-ej95gswqhj
MD5

73ad64d14a97ce7ade406e497b09d85d
SHA1

afe35161360cbbe78396e17ef7638c0097af8428
SHA256

f539c8892d58f4fd0f4cf209ad0486f31ec5b51debd315ef8fb278f0d1b26637
SHA512

309c7d8d892e1fcdd1249f63e3367f48ff3fea67aa3ba1448839657453bef863213699056ea5e27d99fdc098513ee8a723f127eb5d1d3e4302970917672fa7e3
SSDEEP

24576:8tdCzxWfKe9UR1FCBmjwGJkAQy4X1N4QNbJP71SIzKgopvgeum5hD4n:82xWfKe9E1rEGZQTXXdP78d91Pumv4n

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.concaribe.com
Port:
21
Username:
[email protected]
Password:
ro}UWgz#!38E

Targets

- Target
  
  Shipping documents.bat
- Size
  
  1.4MB
- MD5
  
  0b67de290afdcb06218d5ab1a6c3c49b
- SHA1
  
  372ecac4cd7fe8de0f89aff4755683f8fed81a26
- SHA256
  
  669bfc59550b87a86c5e87d33da3e63be15f8712184a6aa176e0021b8c65df1e
- SHA512
  
  fc21a1dc1a1a29a5bdfc0d28f8d1a6be9204a26b7946b08d27e97b4e4c31c4be1caaa0bb9e2b199697ea0ec529ef7165c37ee7bb512c6accdae179f86fd66063
- SSDEEP
  
  24576:ktdCzxWfKe9UR1FCBmjwGJkAQy4X1N4QNbJP71SIzKgopvgeum5hD4nA:k2xWfKe9E1rEGZQTXXdP78d91Pumv4nA
Score

10^/10

agenttesla guloader discovery downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fc3772787eb239ef4d0399680dcc4343
- SHA1
  
  db2fa99ec967178cd8057a14a428a8439a961a73
- SHA256
  
  9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
- SHA512
  
  79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
- SSDEEP
  
  192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
Score

3^/10

discovery
behavioral3 behavioral4