agenttesla

General

Target
64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a.exe
Size 252KB
Sample260306-shm58aa19v
SHA256 64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a
MD5 6bd61fa1cc45c7721a34123449a5442f
SHA1 9499b25d10eb98dc58282f5e26c799d056cb71b2
SHA512 d40b99735594d5da872b7e34d4f0430604af581d312cfe2b2fb4fb85de7107b7de7bf710bf23d1891627312d54ced52103d81c41425d56e95a0cdd7ab92b99e3
SSDEEP 6144:0cBvWb0e4vcCmotxJNIKduziH6+2Rk+VzpA1vqloiE0QO5Gq127:dO0e4UCZ/Jp9a+GtAVyoZoLW
TLSH
T1FD44120672D1C1F3E5734B748D3B9A3BE6D5CB122191960B3B753E6F7CB2306092A162
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.allportcargoservice.com
Port
587
Username
[email protected]
Password
O!nPnH,#{Aqm
Email to
[email protected]

Targets

- Target
  64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a.exe
- Size 252KB
- SHA256 64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a
- MD5 6bd61fa1cc45c7721a34123449a5442f
- SHA1 9499b25d10eb98dc58282f5e26c799d056cb71b2
- SHA512 d40b99735594d5da872b7e34d4f0430604af581d312cfe2b2fb4fb85de7107b7de7bf710bf23d1891627312d54ced52103d81c41425d56e95a0cdd7ab92b99e3
- SSDEEP 6144:0cBvWb0e4vcCmotxJNIKduziH6+2Rk+VzpA1vqloiE0QO5Gq127:dO0e4UCZ/Jp9a+GtAVyoZoLW
- TLSH
  T1FD44120672D1C1F3E5734B748D3B9A3BE6D5CB122191960B3B753E6F7CB2306092A162
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
- MD5 12b140583e3273ee1f65016becea58c4
- SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
- SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
- SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
- TLSH
  T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
- MD5 3cea4c9994912d8f3c3e8b6a814e810e
- SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
- SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
- SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
- TLSH
  T1D51207135A0444B3D9E2223A31AA2F2ED73C9324D0A27D02C777DE5A2BB43166D3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6