agenttesla | be75fbe5f2920e66124bf99561be9e99ae1c3ca8f67b887e6812137a456c382e

General

Target
21072026_1620_21072026_Nomina 07212026_N0021226#1.gz
Size 274KB
Sample260721-ttdllacd22
SHA256 be75fbe5f2920e66124bf99561be9e99ae1c3ca8f67b887e6812137a456c382e
MD5 464715ad849cfae73de65dd26e1aca6b
SHA1 8dfd33ad088d5b8eca91994d332748802efb2d0f
SHA512 7d984c252c3fd042645b78212a4c106d97ff09bd2181267940bd53302d70118996d785bbf8ea4bc7989db3a88debfde7aa52ce0da87fc947e46e385e0becd3f9
SSDEEP 6144:6NkwargTYN3qY7GOV6bG6FmTGSH8x5YX7ijl7zKTEV6:6NG0YN178DvqqBuTEV6
TLSH
T113542357F17E869462E11FE11C138AA6C8F4E474518A04B9A373EFF3621B70FAE44726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.5dejunio.gob.ec
Port
21
Username
[email protected]
Password
osef!t1!#Z8,H378

Targets

- Target
  Nomina 07212026_N0021226#1.exe
- Size 304KB
- SHA256 9856e1947303d24a288bfda2c0523a9d111cda99ca7a3968d45a0b74971330ee
- MD5 32c3deb1393d65c39052b862b2525598
- SHA1 2116dfdf180edf7ddd2a1f1d50f13e6735e1ccb5
- SHA512 61e66c5f24067ca70b35eaf27d009611d2cef732d342483c3fc732fc4df83a92add1379bbb4d34f54e1b50d536595d948244e5f46ad884f7754600ac911d2a6c
- SSDEEP 6144:yB+pgU8O2WlqNhtWMZg2q0RpeoRlffJ6Zd1tW0Esu42BuPb4J7+exCAaFRTm:ygUOxlCnW8g2BRpe6f/0Es92Ib9q8LTm
- TLSH
  T16D6412553686C427C0619B70CC7A89F64518DEF6CA27C30BBB19BFA97A701D28F0D396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery downloader agenttesla guloader keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
- MD5 a4dd044bcd94e9b3370ccf095b31f896
- SHA1 17c78201323ab2095bc53184aa8267c9187d5173
- SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
- SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
- TLSH
  T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4