General
- Target 5e09f995703c957e5b3c7d569264566f17b4ebf83db6606e18eae09e52109f2d.exe
- Size 1.1MB
- Sample260629-nycbfad19m
- SHA256 5e09f995703c957e5b3c7d569264566f17b4ebf83db6606e18eae09e52109f2d
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Attributes
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
true
-
startup_directory_name
gnxLZ
-
startup_env_name
appdata
-
startup_installation_name
gnxLZ.exe
-
startup_reg_name
gnxLZ
-
tor_pid
false
Targets
-
- Target 5e09f995703c957e5b3c7d569264566f17b4ebf83db6606e18eae09e52109f2d.exe
- Size 1.1MB
- SHA256 5e09f995703c957e5b3c7d569264566f17b4ebf83db6606e18eae09e52109f2d
Score10/10-
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Suspicious use of SetThreadContext