agenttesla

General

Target
Conferma di pagamento.exe
Size 835KB
Sample251020-pptd2atlap
SHA256 cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
MD5 a958e7535e035e1963c7586dab036853
SHA1 f51a515beb1c4f6bbde6f2a60d62fa5df7b498ad
SHA512 f26a996dbb8fa967817e7f826a188890a44be582b86c5dcb031c58c29b3695627b36453113dd7a3b4cf75b6132964b67f7cd0848031961b222a2ce0a87cd04cf
SSDEEP 12288:MagM77ZqgnvYFX698r3+wU2GMku9M+ZamHPKMnfDU9sB5PSi96Pd2o0VY8RNzkXK:W87ZaLUepL8bMfDUOBNSivHGw4X7y3l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.dongjln.com
Port
587
Username
[email protected]
Password
LILKOOLL14!

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.dongjln.com
Port
587
Username
[email protected]
Password
LILKOOLL14!
Email to
[email protected]

Targets

- Target
  Conferma di pagamento.exe
- Size 835KB
- SHA256 cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
- MD5 a958e7535e035e1963c7586dab036853
- SHA1 f51a515beb1c4f6bbde6f2a60d62fa5df7b498ad
- SHA512 f26a996dbb8fa967817e7f826a188890a44be582b86c5dcb031c58c29b3695627b36453113dd7a3b4cf75b6132964b67f7cd0848031961b222a2ce0a87cd04cf
- SSDEEP 12288:MagM77ZqgnvYFX698r3+wU2GMku9M+ZamHPKMnfDU9sB5PSi96Pd2o0VY8RNzkXK:W87ZaLUepL8bMfDUOBNSivHGw4X7y3l
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
- MD5 eac1c3707970fe7c71b2d760c34763fa
- SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
- SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
- SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6