agenttesla | 02469c593ecd42b98fd30db086bfc49c9a486d123085a626cf2ab247d7003e65

General

Target
Comprobante de pago.xls___________________________________.exe
Size 370KB
Sample260723-gtht4aha79
SHA256 02469c593ecd42b98fd30db086bfc49c9a486d123085a626cf2ab247d7003e65
MD5 4f1d4fda1144646990ce36efc915d43b
SHA1 b4cccb07fb11d53156e975edad2767ef519efc39
SHA512 86e3ffc225f86e7358da0cb12613b29fc8f145b67696bfcbb80811c91c8fa78ae9700832962ccb26697e7248184154464a8644ad01343903a1df0f88e61d623b
SSDEEP 6144:/mGIhCrl0WKxHId8CSkgTUok86+vQj63bywq7YblDXsBbhq56zOa8:Om0NxodvSke38mWwNDahqPa8
TLSH
T14984CF93FA80C2AAFC3D4C75D9A352341B72ADB696858F4357D875123FA3280353B42E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.5dejunio.gob.ec
Port
21
Username
[email protected]
Password
osef!t1!#Z8,H378

Targets

- Target
  Comprobante de pago.xls___________________________________.exe
- Size 370KB
- SHA256 02469c593ecd42b98fd30db086bfc49c9a486d123085a626cf2ab247d7003e65
- MD5 4f1d4fda1144646990ce36efc915d43b
- SHA1 b4cccb07fb11d53156e975edad2767ef519efc39
- SHA512 86e3ffc225f86e7358da0cb12613b29fc8f145b67696bfcbb80811c91c8fa78ae9700832962ccb26697e7248184154464a8644ad01343903a1df0f88e61d623b
- SSDEEP 6144:/mGIhCrl0WKxHId8CSkgTUok86+vQj63bywq7YblDXsBbhq56zOa8:Om0NxodvSke38mWwNDahqPa8
- TLSH
  T14984CF93FA80C2AAFC3D4C75D9A352341B72ADB696858F4357D875123FA3280353B42E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4