agenttesla | 7858578dd980a870035373a9c70a2257a93e087393dc35a14e735f8fa4869564

General

Target
7858578dd980a870035373a9c70a2257a93e087393dc35a14e735f8fa4869564.exe
Size 556KB
Sample260629-tzmfpabt7j
SHA256 7858578dd980a870035373a9c70a2257a93e087393dc35a14e735f8fa4869564
MD5 492dbd37793c7a3718b34387f65fa874
SHA1 9add49653f4fd81d568efb8d527dabb6cb05d369
SHA512 ebd111e626e9232214db582e617f99aa45c511fcd77ff6022ac8c700f11a50725607f550667e457252a5a16ea54107f1bc89a1fbca977e09e639fd5778b22f7c
SSDEEP 12288:sTsAXF28crKGbJZdrm2opvDE36bWZpeVP:sTs6U8E3JZdrm2oZDfCZkV
TLSH
T13AC4F1A1B745D123DC172A749123D6D28D27BC799A91C933B2DAFB1F23334E26C61329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.holzbrenzii.com
Port
21
Username
[email protected]
Password
@lilkooll123456

Targets

- Target
  7858578dd980a870035373a9c70a2257a93e087393dc35a14e735f8fa4869564.exe
- Size 556KB
- SHA256 7858578dd980a870035373a9c70a2257a93e087393dc35a14e735f8fa4869564
- MD5 492dbd37793c7a3718b34387f65fa874
- SHA1 9add49653f4fd81d568efb8d527dabb6cb05d369
- SHA512 ebd111e626e9232214db582e617f99aa45c511fcd77ff6022ac8c700f11a50725607f550667e457252a5a16ea54107f1bc89a1fbca977e09e639fd5778b22f7c
- SSDEEP 12288:sTsAXF28crKGbJZdrm2opvDE36bWZpeVP:sTs6U8E3JZdrm2oZDfCZkV
- TLSH
  T13AC4F1A1B745D123DC172A749123D6D28D27BC799A91C933B2DAFB1F23334E26C61329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery downloader agenttesla guloader keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4