agenttesla | 342450f80845aa460e9bc267332b4cb5d75373a8d0b1626fe7f3cea64bbee6a3

General

Target
03072026_0205_01072026_OC (Orden de compra N09991212).xml.arj
Size 277KB
Sample260703-chzw1sh151
SHA256 342450f80845aa460e9bc267332b4cb5d75373a8d0b1626fe7f3cea64bbee6a3
MD5 ac19a0fb012d4d2ba4bec0bed3e66961
SHA1 8fc12d3c4d3bed488cf570ac61852f3e67bcae2d
SHA512 02796d4057789e71f925927127a87944add9aa7211c875e945147c70e96c460e55c97aae00826caee5679541268fdb5f4429a016ba70ab600ffdeaeb94c93b59
SSDEEP 6144:mV0qC5Nf9WJ+sH6860/H3lgT2EXPR8yRuKfV1WXr4W8W:mV03Xf9WQsd6ZyKR8yR1+4U
TLSH
T18A542328A5E18276D542F2F0AF344FDE3B876C7D9B5A10EEC534B5E032974671A3C60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.artsystem.gr
Port
21
Username
[email protected]
Password
1Z}Ua+oH1{~v

Targets

- Target
  OC (Orden de compra N09991212).xml.exe
- Size 388KB
- SHA256 f0f153962115ea9c51c8591360d45d483ea4700475a66ec09213eb7832d6410d
- MD5 52fa117b71c087d3b0bad27cdafd803a
- SHA1 e875004990f5df84d12aee0e17b4dc2ee91b925f
- SHA512 36cab5cd5223a2eeb4cc9260e3c21dccbc23dd014013852c6e51da0bad26ece86a5f34ec11ce85ac35ab5fcc96271fc38765889093ff52ed11d317ddefd10a98
- SSDEEP 6144:ZGMoidXz0d+jF8s7aiA3fqBi3FfLTV+HXh/xF2SxStRoPD:ZGsXZjF37aHP3FfXV+3VqS9D
- TLSH
  T11B841246FB30DD27CE5E853059399FF92EADDF2E40596B2B17003698ACB2341621F356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader collection agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Family: Guloader,Cloudeye

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4