agenttesla

General

Target

2bb1066b38de737899e64cda171b4129311489ef1cf184246be198af04e9cc7e.exe
Size

280KB
Sample

241122-291p3asjat
MD5

7f93d7a8cd713042ee9c2c9bb2b43ad4
SHA1

aa09b49ede392bb40a0bda004da44a92dfa0ffcd
SHA256

2bb1066b38de737899e64cda171b4129311489ef1cf184246be198af04e9cc7e
SHA512

67fa9c23ef11cc3185930ef1228fc3dc489f3dac0b396e227da324a549613920f0aa98466a4b1a0abd36d5e7c742547879c82e9bc0f6b6f4c6dfc99e9e4576ac
SSDEEP

6144:yBlL/Dw881QGO0yb/kMnGjqWjtq+5RS/ba:4hQQNnejtr5Mm

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1900836728:AAEDyoYbBJwtt1EA4hdgRlGTN1cq760KPNU/sendDocument

Targets

- Target
  
  2bb1066b38de737899e64cda171b4129311489ef1cf184246be198af04e9cc7e.exe
- Size
  
  280KB
- MD5
  
  7f93d7a8cd713042ee9c2c9bb2b43ad4
- SHA1
  
  aa09b49ede392bb40a0bda004da44a92dfa0ffcd
- SHA256
  
  2bb1066b38de737899e64cda171b4129311489ef1cf184246be198af04e9cc7e
- SHA512
  
  67fa9c23ef11cc3185930ef1228fc3dc489f3dac0b396e227da324a549613920f0aa98466a4b1a0abd36d5e7c742547879c82e9bc0f6b6f4c6dfc99e9e4576ac
- SSDEEP
  
  6144:yBlL/Dw881QGO0yb/kMnGjqWjtq+5RS/ba:4hQQNnejtr5Mm
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ilrl.dll
- Size
  
  39KB
- MD5
  
  76edb1ef7191b88b1f7aef00578fa233
- SHA1
  
  ac139239a33a9c5010498682842598b3db8cfe47
- SHA256
  
  d443dbd070c2c9bfc89727fbba164ead77f562cf29f959762342807ca4f42704
- SHA512
  
  111ad9c3b7ba63ba9a44e3bd73049469d6fd6f159a2dc7447b1e7ac0ae342fe091e235582a9990213e703323a7afeb96fc1d756576da5dbae8d1ad96641e769d
- SSDEEP
  
  384:PN2NM1++IVFCNnhqFartR1836QlVq4kn6RRCj+7+5YkyXLQY2eCxsd0MSJ:Vb2VFCNAFaJ7arlVhkl5YpSeCi0v
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4