agenttesla

General

Target

07112024_0021_05112024_10029384756.IMG
Size

1.4MB
Sample

241107-anhhtatlbk
MD5

859fa5aa930b8f71e6c94b6b60476d59
SHA1

14d29f5c33669c7e35ff4013184d954fa02c6856
SHA256

962464515210d153071344576be7b378c8ee96431aa207ff72801b2a8b559922
SHA512

07a580053dfd402b3bb2601dc62694919be5713d9e7e35b6b1ca2a363693b69153148c675624bd19060c6839937c429d675f34b886f2696ea8917e5ddbd5ed0f
SSDEEP

24576:+WO703h0R6ZL7h1sb1YDij7wt54gjOfHb:lokh0u91SYDrjc

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://mail.hearing-vision.com
Port:
21
Username:
[email protected]
Password:
LILKOOLL14!

Targets

- Target
  
  10029384756.exe
- Size
  
  842KB
- MD5
  
  8baafa32d7de3e0ba360e8df8c95e509
- SHA1
  
  65555b69b67f242a68c83a1735d7764bcbb417a0
- SHA256
  
  45a450142e00de4a60676d56cee58b35e2c59c0af562c7740cfc7c42c2175ba1
- SHA512
  
  ce7b7897a037269e646f7f71d00100c463582f3b786f90b68916b4dd5ff9e60e3d85fdcf3cb1ecbef1de9c4ba21fb9a4770b50b97d8a3c0b6735a2062274d0d4
- SSDEEP
  
  24576:lWO703h0R6ZL7h1sb1YDij7wt54gjOfHb:ookh0u91SYDrjc
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan guloader downloader
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fbe295e5a1acfbd0a6271898f885fe6a
- SHA1
  
  d6d205922e61635472efb13c2bb92c9ac6cb96da
- SHA256
  
  a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
- SHA512
  
  2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
- SSDEEP
  
  192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
Score

3^/10

discovery
behavioral3 behavioral4