agenttesla | 610512fa12c1bb7cb6f86721a82f0d49a9efa3be28f47525fb671cb6974cc369

General

Target
22072026_1609_22072026_przenosić.rar
Size 2.3MB
Sample260722-tlq7qaydkd
SHA256 610512fa12c1bb7cb6f86721a82f0d49a9efa3be28f47525fb671cb6974cc369
MD5 26d59625222a5822f60904adb2be1953
SHA1 f274b71c13e1e42b29c5724e09d4042e982faa0c
SHA512 5375c457ada49c1272321657400f2f44564004e726c624e32e4e34b5da46bbf9183c2bdf3cb4af0c75bc55f01f7820833966fdc77320439a4ce03859061d4beb
SSDEEP 49152:JvHCDBazixjaiElcs3NUXI+0mJlkXeZlER9VsRBrwOYYDp00F1mUhnTMXIhB:JvHYBazoaiElcYNU4G5lEAojYeu1ZTQe
TLSH
T15EB5330189F2E624BD99C778BCBAA171C2594763CE219143FAB7B52DB9B67F43109303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.vilimorin.com
Port
21
Username
[email protected]
Password
Agh30Zw0KmT_

Targets

- Target
  PRZENOSIĆ.JS
- Size 3.5MB
- SHA256 ee63c148ed8b5aa52282cff10bafe84a07ac313d5f29fe8dc2ec3f19145f1d44
- MD5 5feedcfb3b58db828ac37e8b41bb1a1c
- SHA1 23a2bd487b6b29716b4a270411bd876b6e6a0fe5
- SHA512 22c3283e058bd0ca9db76dbe40a9f11492b0f2e3fcb4d0e62d003e1a6b31aef40ae2fa8e50cb7b5e9d2add42102b22c44bb3d691f88ec88848108a8d7fee467d
- SSDEEP 98304:wZpaXatlQingnE5j5U8SP+vglrA0RzG7cIwcdblb9SKWdSJ+LwhbnM:se5intlU8i+vglrA/9rSZEnM
- TLSH
  T10C06F8209724A831221DD37CE13DAF68990E604331DCDF1E315F95A8B66BE0FA7596E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  transferencia.JS
- Size 3.1MB
- SHA256 16079948ca33a86a1d992ac2b21cb33a9eb1735018512ee380b7f9614ffb0959
- MD5 ed23dbb936545706f58a85b601d770c6
- SHA1 941ecd2846044df894e5d2a8de12812c8e1422d2
- SHA512 e33d2f3a9c8c42313cc2198a5319aebf1b7b288f93c8c08123da10363938b094b34e39c52a9247de91c6fc2c98b92a8c0a8752528b96168822c522d08af7c0fa
- SSDEEP 98304:8BNmn3cDGG71U1yOo+bQQyw0LuZCCtI94PYi1jADKukm+:GwnMhV+bQQywftdAi9Afc
- TLSH
  T104E5F8119774A2337325D79C923ADE38540E604328EACF59316EC2257A5CECBD369BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection execution agenttesla donutloader keylogger loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4