agenttesla | 059f89bc7b83b669362cb3ce1182508255c2e97c296c1b9820415d0a9b1ba3d5

General

Target
00992883xeroxscan.exe
Size 219KB
Sample260623-mcl33sby8q
SHA256 059f89bc7b83b669362cb3ce1182508255c2e97c296c1b9820415d0a9b1ba3d5
MD5 214e97b9f597cbb2422a4cf062c8154f
SHA1 3a9e07ad7d205d67d2e1e2608fc85c9a92418380
SHA512 97ad95612c32b636a0b2b905c74985226cca74363f211a8f8295b2b5f83ebebba4a176eb1402a560cb91a1fd77413a3623769e455ed266526979b258bfafb135
SSDEEP 3072:GDxaVzwmg4CSW8JSu5hMgtOp1ftYqzxa8UrgZFbfeC9PFpJ6vU9nJUMiLJFIHf5G:YMm4CCBMq+12X94FyuPJ6Mj3ho6e
TLSH
T1BF24F11026B1D4DBE8129075C96B9FF55AE0AD12DE64478B23C4BF9E3C39BC1DA0E349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.holzbrenzii.com
Port
21
Username
[email protected]
Password
@lilkooll123456

Targets

- Target
  00992883xeroxscan.exe
- Size 219KB
- SHA256 059f89bc7b83b669362cb3ce1182508255c2e97c296c1b9820415d0a9b1ba3d5
- MD5 214e97b9f597cbb2422a4cf062c8154f
- SHA1 3a9e07ad7d205d67d2e1e2608fc85c9a92418380
- SHA512 97ad95612c32b636a0b2b905c74985226cca74363f211a8f8295b2b5f83ebebba4a176eb1402a560cb91a1fd77413a3623769e455ed266526979b258bfafb135
- SSDEEP 3072:GDxaVzwmg4CSW8JSu5hMgtOp1ftYqzxa8UrgZFbfeC9PFpJ6vU9nJUMiLJFIHf5G:YMm4CCBMq+12X94FyuPJ6Mj3ho6e
- TLSH
  T1BF24F11026B1D4DBE8129075C96B9FF55AE0AD12DE64478B23C4BF9E3C39BC1DA0E349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4