agenttesla | 15fa3c9b0f69a7ff9d4947dbf4ab6ccfdafe819768408926d4d96fc5f0b7bbe5

General

Target
15fa3c9b0f69a7ff9d4947dbf4ab6ccfdafe819768408926d4d96fc5f0b7bbe5
Size 1.2MB
Sample260708-289atabs9y
SHA256 15fa3c9b0f69a7ff9d4947dbf4ab6ccfdafe819768408926d4d96fc5f0b7bbe5
MD5 84f1d5d6a41a83d97f8e18ae5f2bb836
SHA1 3fa8c693270eda00e026a6babebef12401b79055
SHA512 0410652e9f8ad33ff3b870e59269a9ba7a91cc8b5242053c49f1850f7bd0faf1d6239ab87a01e59861f23f4451afe5ac28d22b03445ed8188e6fefadad085e75
SSDEEP 24576:/lJtWpsxy6cTIV+Pjn9Pq35Bnh5nYTQXVWSDNFGszyNt4wcPgG3Bmdgba++JZq:TtWixEs8jn965TsQXVfNFDzqdG3uWxYq
TLSH
T1CF4533D0136CB24EFFC90CC4673741F248BB6721E22A7B5AD6953997F62F786642E060
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.piovau.com
Port
21
Username
[email protected]
Password
Payment@123456

Targets

- Target
  Payment_Advice.JS
- Size 3.0MB
- SHA256 285223e2763c02e8e43b6a78560d66c7d1305abee5bdd67aaf0764d2bb6a9dc2
- MD5 aa4d011f983759b19e10cc32685f44c5
- SHA1 7b85c8e02c04c30d3fdb1a0145c4e5ff29121b57
- SHA512 39488426ae5f0d4d25de3b15003fec9e28fb24fc4a782fc0bcfd08ba5b92436655bb4a00452d99bb47b2f12651ad8abe995cbb41b94cd573b9a99f692166975c
- SSDEEP 49152:Edn7HlArbXusbNsP4BBZcxx+Y5b3d1rXtJZWCYN+UupFbghBb4izc74lFQ0c3ZtH:Edn7HlArbXusbNsP4BBZcxx+Y5b3d1rz
- TLSH
  T100E54B8155E4A1633371EBEE462EEE35D40F84432819CF54798EEB38782DE8AF614763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection execution agenttesla donutloader keylogger loader spyware stealer trojan adware persistence ransomware
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2