agenttesla | eca08143041ebb8852d060ddf24b9a263c3e83eb2f4b0e15bf77bb3c15cb6c43

General

Target
02072026_0408_01072026_Directrices de polticas para empleados 2026.pdf.rar
Size 301KB
Sample260702-eqgrhsbw9t
SHA256 eca08143041ebb8852d060ddf24b9a263c3e83eb2f4b0e15bf77bb3c15cb6c43
MD5 b3d29b561889188bb21ac22a9fb53c87
SHA1 deb8e5c4d31ac04dc0cf77666256310b170ee2dc
SHA512 26f05d9ae4e89d9cfac797de05787183e67ad09ee391f0a0bdf6ca7e77669a0157611d8e12a4167945d373e7085a82f18ab4c27000db95054556b06867e2e003
SSDEEP 6144:jJ1vwYtm2Z/bKhD3W16gnLd1ctVlDlG8LDnbO4LWeWjitLzsN8u:11vjZTKhDi6euPlDlG+4HOzHu
TLSH
T19864231A272B6DD133C14F60056B198D6D84DA30629E4DBEFFBCBD033AAC65E4FA8514
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.artsystem.gr
Port
21
Username
[email protected]
Password
1Z}Ua+oH1{~v

Targets

- Target
  Directrices de políticas para empleados 2026.pdf.exe
- Size 334KB
- SHA256 4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8
- MD5 415cda707edaa722ca7aac2ef2a0cd78
- SHA1 6baf8e90e1fcfa7341e67138e3720c52d840446d
- SHA512 3cc5078055ff0ce32665eb3545de1205451ff8a4286098eded69339bb38a868e0da3168f88658584675e532d3552da9d094adaadd633177bba9d785e61171c71
- SSDEEP 6144:f0Mm4CCx78Zmfz2vymL4DFQqmAlr/7oFLTebGtafGjJyjiBA:sMwI74gSymLMCqm/Teagdji
- TLSH
  T1F07412123761D4B3D6B146302D76D23526A1A7EA3911D76F13A0AFC47CB2FA21E1F329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
- MD5 a1da6788aeaf78ca4ae1dece8019e49d
- SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
- SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
- SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
- TLSH
  T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4