agenttesla | bbfe33f2fd8ba24ac333d2f81348472bb4cbdd33bf317cb55dff63d7b9be3269

General

Target
bbfe33f2fd8ba24ac333d2f81348472bb4cbdd33bf317cb55dff63d7b9be3269.exe
Size 543KB
Sample260629-trd5caa18k
SHA256 bbfe33f2fd8ba24ac333d2f81348472bb4cbdd33bf317cb55dff63d7b9be3269
MD5 77c5b17a0006b39c1a4c988bae6c5763
SHA1 42fb563c75fad6707afb59676d09f951156adeca
SHA512 80059ea27b8622b01c746630e6bf56c29791c22f03bda065d134b972c8300915f283a0a065c04bf79b1ebfb9c4cbc14c12d2f5c8468760a9f5d52c1019fc1355
SSDEEP 6144:cT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6ZN8I2kTz41CbbX0XqevgLnOMzDzh:cTsAXF28crKGbJZN8IwWbXoq4grN
TLSH
T100C4F1A1B645D123DC1729B49223D2D2D917BC399E91C973B1EAFB1F23374E25C22329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.holzbrenzii.com
Port
21
Username
[email protected]
Password
boygirl123456

Targets

- Target
  bbfe33f2fd8ba24ac333d2f81348472bb4cbdd33bf317cb55dff63d7b9be3269.exe
- Size 543KB
- SHA256 bbfe33f2fd8ba24ac333d2f81348472bb4cbdd33bf317cb55dff63d7b9be3269
- MD5 77c5b17a0006b39c1a4c988bae6c5763
- SHA1 42fb563c75fad6707afb59676d09f951156adeca
- SHA512 80059ea27b8622b01c746630e6bf56c29791c22f03bda065d134b972c8300915f283a0a065c04bf79b1ebfb9c4cbc14c12d2f5c8468760a9f5d52c1019fc1355
- SSDEEP 6144:cT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6ZN8I2kTz41CbbX0XqevgLnOMzDzh:cTsAXF28crKGbJZN8IwWbXoq4grN
- TLSH
  T100C4F1A1B645D123DC1729B49223D2D2D917BC399E91C973B1EAFB1F23374E25C22329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4