agenttesla

General

Target
Procentdelene.exe
Size 870KB
Sample250701-h17bps1yby
SHA256 1eb25e230346fb5ff10dfd8daad216200205b958046fb2729b8666ba2f18f2a9
MD5 68786837fdc79d05d4d183f7e4dd1546
SHA1 a28c215c0c5c807f05e44063fbaf69526cf7f3b7
SHA512 24af354f735e24ced6c4fa83e72d7a10ea97fefb6b09201b5b2d91b2a5b97d5cace1c44624e06168a81672c68db0fdb0c41b40020beaf7e66967c73002bd0284
SSDEEP 24576:GFMMMMMMMMMMj9sbv93+MEySx9KNQ6SW/AJIoK:GFMMMMMMMMMMjY+MEycKm69/AU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://inhanoi.net.vn
Port
21
Username
[email protected]
Password
^TSt3!FK$UBA

Targets

- Target
  Procentdelene.exe
- Size 870KB
- SHA256 1eb25e230346fb5ff10dfd8daad216200205b958046fb2729b8666ba2f18f2a9
- MD5 68786837fdc79d05d4d183f7e4dd1546
- SHA1 a28c215c0c5c807f05e44063fbaf69526cf7f3b7
- SHA512 24af354f735e24ced6c4fa83e72d7a10ea97fefb6b09201b5b2d91b2a5b97d5cace1c44624e06168a81672c68db0fdb0c41b40020beaf7e66967c73002bd0284
- SSDEEP 24576:GFMMMMMMMMMMj9sbv93+MEySx9KNQ6SW/AJIoK:GFMMMMMMMMMMjY+MEycKm69/AU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla guloader discovery downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4