agenttesla

General

Target
fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe
Size 957KB
Sample241106-rc9xcs1flc
SHA256 fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c
MD5 d568fb4c0cddf5887bad2fbf5f5ca86c
SHA1 e6d22823b47b320d050e37b56203533663d87acc
SHA512 40323026e5065d8b67fff614dbc55e0ca53503e61c773c8238a3fb96de303cf9b380e62a9a69161359c3d7151e47e40db4e844164f8546a909ef2075bc88c362
SSDEEP 24576:RqvOM9b2WIHNlnKjao70yyscrh9+tW40OG:KOMcZEaxymtQW9L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.concaribe.com
Port
21
Username
[email protected]
Password
ro}UWgz#!38E

Extracted

Credentials

Protocol
ftp
Host
ftp.concaribe.com
Port
21
Username
[email protected]
Password
ro}UWgz#!38E

Targets

- Target
  fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe
- Size 957KB
- SHA256 fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c
- MD5 d568fb4c0cddf5887bad2fbf5f5ca86c
- SHA1 e6d22823b47b320d050e37b56203533663d87acc
- SHA512 40323026e5065d8b67fff614dbc55e0ca53503e61c773c8238a3fb96de303cf9b380e62a9a69161359c3d7151e47e40db4e844164f8546a909ef2075bc88c362
- SSDEEP 24576:RqvOM9b2WIHNlnKjao70yyscrh9+tW40OG:KOMcZEaxymtQW9L
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
- MD5 6ad39193ed20078aa1b23c33a1e48859
- SHA1 95e70e4f47aa1689cc08afbdaef3ec323b5342fa
- SHA512 78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
- SSDEEP 96:qIsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9Fug:ZVL7ikJb76BQUoUm+RnyXVYO2RvHFug
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4