agenttesla

General

Target

499d0e04aeabb42bfa3d686bc65b45b3b116116cf9231ea2717569e44dcfc8de
Size

1.6MB
Sample

250120-bkztcsvlbl
MD5

dee2869279e821a2f5d2185c2a885d37
SHA1

2ca86524216afd9d8d3fad0393bda0b06ccc781d
SHA256

499d0e04aeabb42bfa3d686bc65b45b3b116116cf9231ea2717569e44dcfc8de
SHA512

476c8a1687244c0bc08e855b140fcf047771ec25be90594d9dfaebe108dd697fd7454063d5018d9497e27b06dd464c0c1b4f65350c5754e67398997c42d187e2
SSDEEP

49152:vFjEcfASn65XZ3AHMsEBYBHyDjQ3bjgwNmCzfa:vFjdfAS6jK2YgDjmgw4CW

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.transotraval.cl
Port:
21
Username:
[email protected]
Password:
vIZ2P]dt&a!d

Targets

- Target
  
  Order confirmation for PO 7UH2025.exe
- Size
  
  549KB
- MD5
  
  f61aec6b837c52490e5af74f2558decd
- SHA1
  
  90d0c4a77384dcfb04b27f66a889e8bb627ff06c
- SHA256
  
  9c0ad5329e00794b6b9591cf7f4f633cd2d0e3d1209d50b99cb48838fe63b79a
- SHA512
  
  c8cadeef5cf02efbfa34df770063a78b82ff2ca5280bb0b47f85e41e9609c3978ec88cc4ddb6cf2fc7fbbad0547215ef3c61f7721e1c66315061ec2ee8ec17fd
- SSDEEP
  
  12288:2pzQijkXRZXMnWJsGQkHgQ0cNrSdSG774u4U4U4U+H0U4H0U4UjU+J4J4H4f4D4z:kciwXvXrQkHg8NrSdSG779LLLS/o/L49
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Qt5Core.dll
- Size
  
  3.9MB
- MD5
  
  feda5a62cb17c00b53a20c7f4c8a8730
- SHA1
  
  f33b18687201fc234561ccdc3e1b9749a82ca5db
- SHA256
  
  f2f8e1df1c6e7afc972f344b660178bf55f08b8382bae4fb50e6a648ffa7b92f
- SHA512
  
  5fa525d6b94f3d8e36c02bd1f1653ba5fad7f2da0be1651c06cbd67b44547b79a06bcfa11db7c05dc45ae629fe8e45b5551d3f107c12834feb1c50acc2536e93
- SSDEEP
  
  49152:erq55XRUTyV/Pf3n8p+lUw5lxrVE53P1cz+5YlDm4uxqf:aToX1VEd64xqf
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4