agenttesla

General

Target

24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.zip
Size

1.2MB
Sample

250329-h7kraa1ks2
MD5

f9779428f48c8e0895189db6d3c7340d
SHA1

39beed7eb46d65ab7a38f46bc7fba6af13c45bf8
SHA256

3928ecb91adb2eb4aa8dda8e08e862efbadd414aff85a4809850233abd0a7c2e
SHA512

832daf773f01c63b1409f35631689cdc058b884d67c3abfb1be94114577d5bcc18cc7827cc3a08f66322b4d9ebb256d4f5012f18ad2eb45a8c9607e75906e12f
SSDEEP

24576:qo3R+vOWuFqgZdTVyIjz+0A3cYWLnz6A6/2h/YmlpI/oR7OKIudUJkIll/2:qo3fWu89P0Awnz6b21lp0oRgJJRl/2

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.xma0.com
Port:
587
Username:
[email protected]
Password:
london@1759

Extracted

Family

redline

Botnet

success

C2

204.10.161.147:7082

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.xma0.com
Port:
587
Username:
[email protected]
Password:
london@1759
Email To:
[email protected]

Targets

- Target
  
  24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
- Size
  
  1.6MB
- MD5
  
  91521adf3bb37d62cc859b84a3c85fb1
- SHA1
  
  fc3788e6ceaf1c5bbeebbb2c59b55883896ca25c
- SHA256
  
  24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694
- SHA512
  
  d78640b83a4504df2b40f471f8f6ab7bf3342a4478c0bae9b7bcb18194aa08b09683aac940cd860c458d4f1de544ae0d3f45f1e9d1ec8bd1d168ccdc7712e2e9
- SSDEEP
  
  24576:Au6J33O0c+JY5UZ+XC0kGso6FaOfvovS6StpmUO81BPr5hG7XSTqgiTncWR1WY:qu0c++OCvkGs9FaOAShtxOw7GbwxLY
Score

10^/10

agenttesla redline success discovery infostealer keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Drops startup file
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1