agenttesla | ce1ec07fbbe21c03b49ba4b7ca2ca6a5e23c626bbcb45d29926631e114281b08

General

Target
Sin confirmar 958466.crdownload
Size 1.1MB
Sample260720-lc7jcafx3s
SHA256 ce1ec07fbbe21c03b49ba4b7ca2ca6a5e23c626bbcb45d29926631e114281b08
MD5 853c29c7b6a1a8841751c241ef0dc208
SHA1 236d39ca62d983ac862d667ecadd85f28f6dd082
SHA512 66a5d4cd4c85950e423401676fc65a156a2b3e9a2768c1961273c3dd96a96f01e39ca039b59809b8635baefd19d1448c8c5a5509d257a3854849cf1b33ac00ef
SSDEEP 24576:cv2uQiBwFbI8OM03FzuZKVT5GT2+uPokfPXC7wj7XwIqliWcY7T+ZoFBJ:wBBB8kIZyNeuPU8j7XuJ7qZuH
TLSH
T1F83533EC81D43DADF0250748AEAF765C3A6DF4E20D9E80682EF5CE748EBA4551D34C68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.enogcaen-br.com
Port
21
Username
[email protected]
Password
Q@^Z;^J^-K%Q.MOj

Targets

- Target
  FACTURAS Y ALBARANES.JS
- Size 3.1MB
- SHA256 3cc248f3c6a4d3a62940675c527efa309fd3da14ec8a42851965bffed54ae600
- MD5 5ccb9cf4699622225380b2b533618eaa
- SHA1 537b3c63c3c28a11dc4ad9ffb6f9dbc7c4e27ba4
- SHA512 4fa80aa34b7cfffccc2147b3d286a2d05a785349da03a34b4c0801bb3c459d235227601b0363dd7525e32194d48beb474aa953d86ac577b14f7f4ec81857ef15
- SSDEEP 98304:uAzFH5TnWHjf/LngnkkOp1YH4FwjH6W0sBcKIbR4H6lwyn5J2vWclyMXsrH3R8RC:5ef/TXk4qYeHTgbeH66y5UvryMXsL3lZ
- TLSH
  T10EE5D5109764A1367B20E79D9236DE7D540E600325EACF08316EC7297A2DE4BD398FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla donutloader keylogger loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1