agenttesla | a3fe5eada7ca119774b820d3e7107decd033f7158808bc278ab69607d22132a9

General

Target
Docs 10861.rar
Size 1.0MB
Sample260706-s7tz3ac18j
SHA256 a3fe5eada7ca119774b820d3e7107decd033f7158808bc278ab69607d22132a9
MD5 98b66589c4e7ebf05ba74f4087b1ba6e
SHA1 e8b4dc8ee236d0eba866b3c37d73f370a1595a21
SHA512 d276baecfca7fc3e50f422b644dcf1bf89874c48737ee357ba59530113f695185476856b13c132906c4c9fcbb6fd77043fc2565c1753721837ec52d06c85cd04
SSDEEP 24576:lVYWkgotzJbwzo1ibuIcGlcfsHKYJtfEJ89077RhdSfotl:lVorRwosvlUYDF9077RDSQtl
TLSH
T13E353365D859DB0214773B903D8C98766AB6178C3F77E0E39A92FBF00DE719C2C1981A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.piovau.com
Port
21
Username
[email protected]
Password
Payment@123456

Targets

- Target
  Docs 10861.JS
- Size 3.0MB
- SHA256 31fc8dfcba8395ffa1e2696554b8939c62ac8e35c5809b8dd84d1a8c12794f0b
- MD5 966ac42a8d4a5688883c79fe8b0a9c36
- SHA1 00c3d1522659070555083a2ef3cb53d7c65e46e7
- SHA512 5872a377f19599ecebf3a442650233bbbe484fe15a48a45aace3a95583bbf9bda7a4f4b520bb0baadc3c033592bc62ab2ea3e98d903aa8a54e99a9d82354eeaa
- SSDEEP 49152:xgnYV2UxH+feIcJ4+EnEF9X6EosORKu1budZVwpNcNV5W4fCAmto2XMEVP92j1QK:xgnYV2UxH+feIcJ4+EnEF9X6EosORKuU
- TLSH
  T14AE54A8566E4A1233320EBED823EDE35D40E94432859CF54759EDB38386DE4BA354BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection execution agenttesla donutloader keylogger loader spyware stealer trojan adware persistence ransomware
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2