agenttesla | 61393334a2fe5d4f85079fb76fbc98ad159c08672fc35563b7f2825cf0cf1776

General

Target
Zamówienie OR 18257.zip
Size 2.0MB
Sample260720-sr8taaet7q
SHA256 61393334a2fe5d4f85079fb76fbc98ad159c08672fc35563b7f2825cf0cf1776
MD5 5ffd0bd3befc40823c0cd339459b44c7
SHA1 21f8c0f25ad6da77e72960f46bee4bf6cf8c0194
SHA512 a0cd5b0b8cf9be55bac0e60f6e706a9d87ee374ab6c4ac36f01cc9a2c4e4ea4d012a6a1e75e1094a0a85c116fe76fb2da761738d514c3d4cfb8f34df99795c28
SSDEEP 49152:iaU3LCBJxICD2MujQy0dja8W7XcgxmDoBe:ipLCBJ2CDcQ/dja+gve
TLSH
T15FA5339758E732AABF7EDB295F7E2C4F44BDDC28B4CBB740A24B15445E382223105672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.transotraval.cl
Port
21
Username
[email protected]
Password
vIZ2P]dt&a!d

Targets

- Target
  Zamówienie OR 18257.exe
- Size 2.4MB
- SHA256 72a7c6a492a3cacce1994c675f5e94339f9c5e323e29d36e2ed2c5c988bbfd0d
- MD5 9b92abd456d5ed4a2650d2f678797f9d
- SHA1 b28b86d051088a68898ad3069eeacb33b8c07b66
- SHA512 87cf13be700c3addc08ed1b0fd1f2dd8820b8995c2741f3593264c779235ee608174a6cbac7803579138d656f34f3e6eff5c1d370bb6b25a6780ca701e9497db
- SSDEEP 49152:KsO10cusKaabv6r8BTqbDGXu3wAtyCNgalRp:PlTNAX627
- TLSH
  T144C58D13F5DA01E8C02ED1798B568222FAA1BC450B35B2DF0A5177561F7BEE86B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1
- Target
  msedge_elf.dll
- Size 2.1MB
- SHA256 305b0760fd3eceb5e28090bf5a473ea2624c66857910c43bd31085ee72821bda
- MD5 849e17e489a5ef8915fa98e77dfd5fe9
- SHA1 f4aaab5eb8a0d3fc925401743a0adecfd34dc588
- SHA512 54841c1093604bccac8a08674b9706e387569ee9658e6a19b6bcc7580216bbc62827e706d49b46e0e55ab65dcefd505be2c924750b365146700a10abfbbf7f4b
- SSDEEP 24576:QqvAfGio2SgLGtCtQ6b4MCLyStbH/PJg7xPrPncxbMcAm15mcmw/jHOuKoUZISX+:QkAfGio26zQDPncWcL/juBxX15zNA
- TLSH
  T152A5BE19E39911B8D577DB78CB52A232D6B078464731E48F0699D7062F33ED09BBB322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral2 behavioral3