agenttesla | 8b7aa781c27a61d8e92cd96f869f54d430e49d33321a484ca8fc28aad034c876

General

Target
25062026_0345_24062026_Ad_MV_INO_HORIZON_SPARE_PARTS_DETAIL.rar
Size 1.9MB
Sample260625-ea546sg17y
SHA256 8b7aa781c27a61d8e92cd96f869f54d430e49d33321a484ca8fc28aad034c876
MD5 e44e6842d1f95e7a85f3c51783d6984a
SHA1 e404b2e5471f27d1975b1c611cd15911d9ade454
SHA512 4ffdd00612277d1ddb276cf508a3842db28ba30bea21e5214c600a7d1269fc65ef421ee7aff1f7c5c9b1c89727995e9a9dc60f282d68a65b1f599c258fdac567
SSDEEP 49152:HcdqX5TNAWiU0R06IU7I5py7BoPPeor7wuAaMnbMyY9sdkQ:HcdUHARFyOo463eor7wuAaMgzyP
TLSH
T1D39533E55677825E1DD1152F242EB224E17B6BC4FC19DDF8EE2C19830BD6438E62D0E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.onionmail.org
Port
587
Username
[email protected]
Password
sendboxorigin12
Email to
[email protected]

Targets

- Target
  Ad_MV_INO_HORIZON_SPARE_PARTS_DETAIL.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
- MD5 bf62f6760a9b86f66822fa59140aef8b
- SHA1 a71dc7dff873a5341ee93a254fa43e61f85298de
- SHA512 f47af18705dfd6beec15109c227ca614dd314ce7a5dc4c19b10fc5388d07cd5990e5ea09128235cd88b595eef91a7c0e63e091bf8fc9947479f3d5d8167d9d31
- SSDEEP 49152:eYqEK9Q8jm5Uzq0LYxjvOPg+BgAiyg8xK90g/u8KwQ61PwST3:lwQD0LYxjvWa3mz8NB3
- TLSH
  T1A1168C17F68903F9C09AC1749B579162F626BC2A2B3562DF364CB2141F7AEE04B7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger persistence privilege_escalation spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Suspicious use of SetThreadContext
behavioral1
- Target
  Secur32.dll
- Size 1.5MB
- SHA256 a538e48ac47bffa0b82971c13a5041c0bece0c6fcc33d85c20115191fe009732
- MD5 56ce5ef399bac87ea801d7f362f20a7c
- SHA1 5afbc95d7882ac10eb8401bf6a4e509158a9a873
- SHA512 bebbb5d0271ba3e02c68df0346b9388025af155542f8c4a8322b21fc7035961cecd7b670f8cb7931d2f95a43fa6a8193ca66dcd4aac6cb9a09b5e49632da71ef
- SSDEEP 24576:xdrQMdP/1sf1/ns0bi1UY8QKGYOs3RN4i3nHKyiGDhkZuQS7uFVMI6:xdrQUP/1sf1Z3hSi3HBitfS7Er
- TLSH
  T13D75BE55B3C826E9D557CA349B51A632D2B2792347A2A0CF1A9EC3091FB7BD05F3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger persistence spyware stealer trojan adware ransomware
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral2 behavioral3