agenttesla | c3cdebe80aeffde4de1c7750457b413fe3be0549a51057295d61639cb85d1ba5

General

Target
c3cdebe80aeffde4de1c7750457b413fe3be0549a51057295d61639cb85d1ba5
Size 1.9MB
Sample260729-b875mstxc1
SHA256 c3cdebe80aeffde4de1c7750457b413fe3be0549a51057295d61639cb85d1ba5
MD5 1ba888237039c1c4ceffd1fabcdc7393
SHA1 85a8c4dd9bc10a12f6e87a6f27d1a15782c0d6e7
SHA512 7de6e94f74d8be18ffb9259236207f78c011a8ed992f4f50663c1b5c54e5d7dc179a888df1dd504727d53d8674c232b0d35c998ec9a771c51c7d079e7808b2d4
SSDEEP 49152:6mopAs8wDXUWChT4DzzkvBmopAs8wDXUWChT4DzzkvN:6ZPfkY/A5ZPfkY/Al
TLSH
T13A95334C773753CF572AD8BA0EE868C613C32488664993A8E7986E17794D326FC3158F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.acellemez.hu
Port
21
Username
[email protected]
Password
7P&3E1V4b7!#Af[V

Targets

- Target
  Shipping Documents – BL and PL.JS
- Size 3.4MB
- SHA256 78379084259cb2ce21139fdd0f34f9e11b3934c09f7e764636b6d7d3cc94689c
- MD5 6461c063f7163aec299b03bf9b5f40bf
- SHA1 b3ac93661dd0d706dc0c96640ee5f66680d8be38
- SHA512 74249b451290b99a12da248eaec992a6a885e51bbeb39df48849f8ac3b0afb2c0044eeab8338085fc4a2aa028e84d5812f0c8662cdd12af6f5dd8e7c6a804353
- SSDEEP 98304:5k4SSlt0MU0VOt7yDCDkpOxJghp2sNCG+MivgTgyhla0XVe6mZ:a8DsYDVmJghp2yTthVA
- TLSH
  T11FF5E8005728A0733712E3DD5336DEB8980E900324DACF54355DD624F5ADE6BA3A9BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla donutloader keylogger loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  doc8003748857950007272026.JS
- Size 3.4MB
- SHA256 78379084259cb2ce21139fdd0f34f9e11b3934c09f7e764636b6d7d3cc94689c
- MD5 6461c063f7163aec299b03bf9b5f40bf
- SHA1 b3ac93661dd0d706dc0c96640ee5f66680d8be38
- SHA512 74249b451290b99a12da248eaec992a6a885e51bbeb39df48849f8ac3b0afb2c0044eeab8338085fc4a2aa028e84d5812f0c8662cdd12af6f5dd8e7c6a804353
- SSDEEP 98304:5k4SSlt0MU0VOt7yDCDkpOxJghp2sNCG+MivgTgyhla0XVe6mZ:a8DsYDVmJghp2yTthVA
- TLSH
  T11FF5E8005728A0733712E3DD5336DEB8980E900324DACF54355DD624F5ADE6BA3A9BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla donutloader keylogger loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4