agenttesla

General

Target

09122024_2315_09122024_ZAMÓWIENIE_NR24120117938022.IMG
Size

1.5MB
Sample

241209-28pamsvme1
MD5

209d612d3fd23f6e0151bb2cc81b0993
SHA1

a5b650a280c788a6c7607e3b9b435e27af94c0df
SHA256

6a58775b1bda073351933d2b4d7347f4520c6631602acce063d1c0bdedc0890f
SHA512

5472243ad5ada4ab49c725e46a888593f862e242aeec8443dfac269b306598098ebb4ecefac0d1019ff5fb96dc53119b34cc3ed07b35319e29f0ba36d270aa64
SSDEEP

24576:kYB//x9siaesoieYuVffHku3WggclxxIJzsGO:t9//FAUHffHkumggclxGZ

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.rusticpensiune.ro
Port:
21
Username:
[email protected]
Password:
hr,d@KUwa5llI%*RNL^J]g%8I;!;_Ne#G1h~lE!*86DAAD6#iLm$x)r+e1z$p+_Q,4_(f!};B?vD!IG?NqT[zOHNr6_nww[S]V?MlcYSt_QO

Targets

- Target
  
  ZAMÓWIENIE_NR24120117938022.exe
- Size
  
  999KB
- MD5
  
  5c45c0877fb82d10594fde27ceef591d
- SHA1
  
  ea68349b2af800d39680cf50da9e3284ec1d52a4
- SHA256
  
  b7e96f5e7dc899dc84e8eb7d63c867f38e8b742c2e44680dba593969ff148052
- SHA512
  
  d6497d61d8bbf155223fe4554783b0e86ab326ffb20bbbac4b444e0d27f16715458bf055085732c4204cbccba84419de62bd75615602a291e26c1dbc74a6bda9
- SSDEEP
  
  24576:+YB//x9siaesoieYuVffHku3WggclxxIJzsGOB:j9//FAUHffHkumggclxGZW
Score

10^/10

agenttesla guloader discovery downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral3 behavioral4