agenttesla | 0e42c37980066623c0d784accb3e8d62bb36da411665caab671b752517e3faea

General

Target
04052026_0924_03052026_MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.zip
Size 1.5MB
Sample260504-lc2yvsft61
SHA256 0e42c37980066623c0d784accb3e8d62bb36da411665caab671b752517e3faea
MD5 005ba5ac0b903fca9b35f2c4d8733ac8
SHA1 e6820075c7163047fe56a95fc4e04d7e4f322223
SHA512 b157e2a91e3c6427f9b7d12f61ae470d1d7b55e8c444f6604070311a0c4bed59111f7e85c683e162813fd30ff70071096fa544084fee246c2f5ecbe0abac3928
SSDEEP 49152:4O3o3DR/Rpc6A+W6cWF3DpJet0FJj48QWE0UY:4l3DRZpuOLGqW8N1
TLSH
T16375334559AF82C9E6B1CEF0C34D39ADFB9A61C5306826DA9DF36F609C0F20851BDE14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.onionmail.org
Port
587
Username
[email protected]
Password
sendboxorigin12
Email to
[email protected]

Targets

- Target
  MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe
- Size 1.5MB
- SHA256 232fa5792839dc677b0211b3694954e9660b174aa0f9bedcab772ac1e86d3843
- MD5 e31770026101eaccb1b5de7cffd52033
- SHA1 235beed3a3c2ecb6415eff789d2f4deb2cd28c3b
- SHA512 c65068629659f5e11e0580e57f10f14e685b4e7fe26e30e2447bc5c74fddaf8c233d095bb96df4b982b2695048a5e4f7c7d5bc138613fbc69db86a05dde6e9cc
- SSDEEP 24576:WdpUGxARynhYYI6dwnHL3b5qbDCLTTG/Zl1kngqi6Qj92dgysZI:Z/RynhYYlEbb5Q4TT05hxY
- TLSH
  T1B9758C13F29902E8D06ED2B9CB568132EA61BC060B35B6DF069073552F77BE46B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution agenttesla keylogger persistence spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1
- Target
  msedge_elf.dll
- Size 1.6MB
- SHA256 74b74a44654abaa50f6934f63c28638d38891bedd5a349b4baf8ac8602ce6f0e
- MD5 27eb99ed934ded69b5e87722fc47fbc7
- SHA1 fc9bf62e8104faa57b727dbc0238f294cc040f17
- SHA512 52a1b2715636eac30649e0ce54e232f64c9e523ad1326c23b04949a11de418f977ac5603435374eed1e227b84393b837ce3e7a70c4054a2523c2947659ec0c72
- SSDEEP 49152:uDqHKWOMUqQnxAm1On1DYJBKg376OfI/7Wl:F8AmU1DYJBKg376OfI/7Wl
- TLSH
  T18A85BF69B3D82299E567DA39DB11A323D1B278124772F0CF0A9A13091FB7ED15B3B701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution agenttesla keylogger persistence spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral2 behavioral3