agenttesla

General

Target
DZ__0002.EXE.exe
Size 874KB
Sample250926-haxpkseq4s
SHA256 e715ca77bca80baec611ba2f5982ce26a52211523f2db2115165e593b65ff6ef
MD5 3411fb6f74583251ac0f556d10d80fba
SHA1 87a1f01f1a44eaa39401f1d4e82b5dc6206d728f
SHA512 4063e792d0216ff9c394f2fbcabf11a8216eced6cf637800400aa81bb4089d04b6e475d83e5c2a2ae8a2aa20bd5ae79ed6c4a3b1d7a0cb7a11392d5dc3b9e06c
SSDEEP 24576:4zHGYjwFi+5iRK68N+myIwFWmrEECmcIQVtNT7C:4J8lYRKv+rtWUEEdQTNa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.rusticpensiune.ro
Port
21
Username
[email protected]
Password
hr,d@KUwa5llI%*RNL^J]g%8I;!;_Ne#G1h~lE!*86DAAD6#iLm$x)r+e1z$p+_Q,4_(f!};B?vD!IG?NqT[zOHNr6_nww[S]V?MlcYSt_QO

Targets

- Target
  DZ__0002.EXE.exe
- Size 874KB
- SHA256 e715ca77bca80baec611ba2f5982ce26a52211523f2db2115165e593b65ff6ef
- MD5 3411fb6f74583251ac0f556d10d80fba
- SHA1 87a1f01f1a44eaa39401f1d4e82b5dc6206d728f
- SHA512 4063e792d0216ff9c394f2fbcabf11a8216eced6cf637800400aa81bb4089d04b6e475d83e5c2a2ae8a2aa20bd5ae79ed6c4a3b1d7a0cb7a11392d5dc3b9e06c
- SSDEEP 24576:4zHGYjwFi+5iRK68N+myIwFWmrEECmcIQVtNT7C:4J8lYRKv+rtWUEEdQTNa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery downloader execution agenttesla guloader installer keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
- MD5 fbe295e5a1acfbd0a6271898f885fe6a
- SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
- SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
- SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
- MD5 ab101f38562c8545a641e95172c354b4
- SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
- SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
- SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6