agenttesla | 696eaa75f826a1cc8c7f3e477baba09f9c68eb1d1b6e0d97039fa06f9f9f13e6

General

Target
SCORPIO_Monaco_Orderpdf.gz
Size 932KB
Sample260622-lpaedaax8k
SHA256 696eaa75f826a1cc8c7f3e477baba09f9c68eb1d1b6e0d97039fa06f9f9f13e6
MD5 87e73987baa9e97b6be8e9cd5c7d2d29
SHA1 5f06c56a91d1f4b64796587cd0a159c93fa29888
SHA512 5c231fb7604703c90c0c3b247709eca1c336b8307fa43c76fcc66d7945096147919ae6996798715d572cdbc7968371d2b1d1961c4441b77d0196166a61b566f9
SSDEEP 24576:UltH8ocJd3ZRggAQoewhbGxzCTpGL7bNzGR7PKVxxc3cl:UzcHc3thyx+pigR7PKZNl
TLSH
T14E15336FE604173052A7CFEC769E6E78745A640538FC2F2BE31C9F164663A8D90910EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.onionmail.org
Port
587
Username
[email protected]
Password
sendboxorigin12
Email to
[email protected]

Targets

- Target
  SCORPIO_Monaco_Orderpdf.bat
- Size 1022KB
- SHA256 15aaf73463293853052302ab88e24885f054bbce3fcbf1a6aa8cf02a4410c773
- MD5 753071565fe55de2efa7255beb83bb8c
- SHA1 bf3fa17b63167d0460fce68f5add46ba4bfba889
- SHA512 5c9e1d9d26e30cd89ec9add1a90f7e254540985199350dd6fc202314a7d68e3963170f78c959e8391c2a3e1061cbacdcc096614176594f9b59440ad8e64c9a63
- SSDEEP 24576:Cr+iDcZwfu3ZdNYKg/duI+GYK/LUbt34HK:k+iQOu3eKg/duI+SLUbt
- TLSH
  T1382501946A59E606C99157780EB1F23903FD2EE9BA11C2165FED6DFBBA32F110C10393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla keylogger persistence spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2