agenttesla | 2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484

General

Target
_2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484.txt
Size 3.0MB
Sample260707-qt7ynaf18j
SHA256 2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484
MD5 f62ce9f485184600ccbb1566a94eb49e
SHA1 fed0426d3c5a6d206220362a8f9c280b8b7c61ca
SHA512 ea05071dd3012bbf562402897dbf76b96d198dbb3e1eed38b4c4920dbaffecd6053e28b972e0789f9cf39223f0028dd5cf8a17df5286664c50487e826e57268b
SSDEEP 49152:huVuojTuMYdGe0KdhKuyTM/5aAu+NGWE7P6xHBpGXUzwcwGiRtFSpevpoLcRQx:huVuojTuMYdGe0KCuyYxaAu+NtEz2HBv
TLSH
T122E5285157A4E133B320EBAD563ADF34980E900328D9CF5434AED229791DE4BA359BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://vilimorin.com
Port
21
Username
[email protected]
Password
;VT59r~N-6]V!m~+

Targets

- Target
  _2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484.txt
- Size 3.0MB
- SHA256 2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484
- MD5 f62ce9f485184600ccbb1566a94eb49e
- SHA1 fed0426d3c5a6d206220362a8f9c280b8b7c61ca
- SHA512 ea05071dd3012bbf562402897dbf76b96d198dbb3e1eed38b4c4920dbaffecd6053e28b972e0789f9cf39223f0028dd5cf8a17df5286664c50487e826e57268b
- SSDEEP 49152:huVuojTuMYdGe0KdhKuyTM/5aAu+NGWE7P6xHBpGXUzwcwGiRtFSpevpoLcRQx:huVuojTuMYdGe0KCuyYxaAu+NtEz2HBv
- TLSH
  T122E5285157A4E133B320EBAD563ADF34980E900328D9CF5434AED229791DE4BA359BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection execution agenttesla donutloader keylogger loader spyware stealer trojan adware persistence
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2