agenttesla

General

Target

rendelés_1023200000000000305.img
Size

1.5MB
Sample

241209-s39vqasnas
MD5

ac423a818e2f12b901639f9da18bf375
SHA1

202754b9083479876116468f95ccc74052902e68
SHA256

0c271973eb1106395acb984d03d6ca21f98303aa3afd21c963ddf80fbeaea274
SHA512

d3ae0f563e324ff6bd59a1ece93282babdd73be48be567a089af82cf1064e67b98d24dc595bc8e68abf8bbe50aacba8136a53d43e558cd4e223510e12d4d9d5e
SSDEEP

24576:kYB//x9sjWsxFLFS8Tppg8bY6yEV+ztrHv:t9//CWWTppm65w

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.carbognin.it
Port:
21
Username:
[email protected]
Password:
59Cif8wZUH#X

Targets

- Target
  
  rendelés_1023200000000000305.exe
- Size
  
  979KB
- MD5
  
  ff83f495808f8837a41405726ce9d7b9
- SHA1
  
  186bb042c4a61b7905ed62bde58f062725897192
- SHA256
  
  186a1d9c4703d9498b26d88451e31018ff66b7f9f135e0ed93f9ac10aa485753
- SHA512
  
  89112cc0a4b7349bbb9b9c2b2e466f895375ee099a27b6a497be3860414f9ad9d8ec87b0dd521e029fc4827ee1e1560b76e319e5b4ea12ac1b76986626f2ddca
- SSDEEP
  
  24576:+YB//x9sjWsxFLFS8Tppg8bY6yEV+ztrHvm:j9//CWWTppm65wc
Score

10^/10

agenttesla guloader discovery downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral3 behavioral4