agenttesla | f2e0bc917d24131983d6515b28308a64a3853964b45d1d7c84d5f989dde93c62

General

Target
RFQ-BOCAN .V03140P26070001.JS
Size 3.0MB
Sample260709-kmsmhafv3j
SHA256 f2e0bc917d24131983d6515b28308a64a3853964b45d1d7c84d5f989dde93c62
MD5 61890d17d3a991a4638fee1dbfef5b3e
SHA1 9fc6dd0a13439aa90e4ae734e46e9b1e3e4f7781
SHA512 307139489281c9e0c446d42249757f1c65a266f87138b37d384181dc8d20c45c080a5382874a68044b9b3dc2c8c8852ec438f32cacd4e0af10c88dc06b989da1
SSDEEP 49152:0YU16uO6ySzEn242oUh8CECzCBaEmsZa0RBPAnd/L1vsQgUoLjwguB4uJ/CvdH95:0YU16uO6yQEn243Uh8fCzCBaE/Z7R6hU
TLSH
T1DAE517415764E1737325EBAD523ADEB8980EA00368E9CF09346DD328795CD4BA358BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.episcenergy.com
Port
21
Username
[email protected]
Password
9YVt7SQBEpyi3GRt

Targets

- Target
  RFQ-BOCAN .V03140P26070001.JS
- Size 3.0MB
- SHA256 f2e0bc917d24131983d6515b28308a64a3853964b45d1d7c84d5f989dde93c62
- MD5 61890d17d3a991a4638fee1dbfef5b3e
- SHA1 9fc6dd0a13439aa90e4ae734e46e9b1e3e4f7781
- SHA512 307139489281c9e0c446d42249757f1c65a266f87138b37d384181dc8d20c45c080a5382874a68044b9b3dc2c8c8852ec438f32cacd4e0af10c88dc06b989da1
- SSDEEP 49152:0YU16uO6ySzEn242oUh8CECzCBaEmsZa0RBPAnd/L1vsQgUoLjwguB4uJ/CvdH95:0YU16uO6yQEn243Uh8fCzCBaE/Z7R6hU
- TLSH
  T1DAE517415764E1737325EBAD523ADEB8980EA00368E9CF09346DD328795CD4BA358BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection execution agenttesla donutloader keylogger loader spyware stealer trojan adware persistence ransomware
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2