agenttesla | 2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18

General

Target
XeroxscannerPO080726.exe
Size 337KB
Sample260723-gpddtaha26
SHA256 2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18
MD5 0ac806ee073f53b035d805fac4f532fa
SHA1 8ed2be4f406cd7012bbc432229c8938a97f02b5a
SHA512 f2c1b46babe641ca4d646af7a76681b1707618b71b0cd624f382748f48cdb2f41e3ecff953d64617866ab5fe5ce820b143e917053f6376e8599f985fa59834af
SSDEEP 6144:GgORaspjQeluy+cu67Vb6+LMi7opmQosCLDVDcooc:Ggyjzuy+B5+LMey9oZTt
TLSH
T18874C0A1F399C8DAEC122275587BEC3325577E2DA874050F216F7729ADB3393046B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.holzbrenzii.com
Port
21
Username
[email protected]
Password
@lilkooll123456

Targets

- Target
  XeroxscannerPO080726.exe
- Size 337KB
- SHA256 2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18
- MD5 0ac806ee073f53b035d805fac4f532fa
- SHA1 8ed2be4f406cd7012bbc432229c8938a97f02b5a
- SHA512 f2c1b46babe641ca4d646af7a76681b1707618b71b0cd624f382748f48cdb2f41e3ecff953d64617866ab5fe5ce820b143e917053f6376e8599f985fa59834af
- SSDEEP 6144:GgORaspjQeluy+cu67Vb6+LMi7opmQosCLDVDcooc:Ggyjzuy+B5+LMey9oZTt
- TLSH
  T18874C0A1F399C8DAEC122275587BEC3325577E2DA874050F216F7729ADB3393046B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
- MD5 a1da6788aeaf78ca4ae1dece8019e49d
- SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
- SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
- SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
- TLSH
  T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
- MD5 9cbefc918a4560f3e780bc927e0e4008
- SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
- SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
- SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
- TLSH
  T1E512F992E6A450B3C5D7533A35AA2F2DCBBD5325B0926C00C7738E4D39355B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6