agenttesla | bf8ea2cce0f253f33fd2d929c7e1e796c73bd296f12f007656ea41b22088d309

General

Target
30072026_1624_30072026_Nuovo ordine n 1557.rar
Size 244KB
Sample260730-twk4fsv1bt
SHA256 bf8ea2cce0f253f33fd2d929c7e1e796c73bd296f12f007656ea41b22088d309
MD5 8c8d4a2fb8e5b5596e8c9f5f34dac0b2
SHA1 4bbc34f843caac1cf712eb7db9bb34d74528864d
SHA512 ea87d3eccfdcb8b8bfe639156e272427440df4b51fb3a183b89d9a493ddad30c3645bb5f5f72497f87d3b89a39a40c3903c8b43196deaf297c78d11bb1905ec6
SSDEEP 6144:7wRK1Y8KydUykGq6HWDVsh+L4H0xdpdfBZSgWa2K:7wRdydRqyh2xdpdfBZSgWa2K
TLSH
T1113423E88A69BBAB726437D6CFD1696CD4DF8BCD5331324AF9C38918127159024438EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.holzbrenzii.com
Port
21
Username
[email protected]
Password
boygirl123456

Targets

- Target
  Nuovo ordine n 1557.bat
- Size 339KB
- SHA256 476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82
- MD5 a6d9343937044aa2bbd88242d974ce2c
- SHA1 40d33bf4f95194808ba18b5d818810c3026a5c32
- SHA512 cae7e5f1c44ed23fe7c336508915388b7f267ecd10189496653ed3f47d379ebb5f99e3e1b8411851176048a8877a7f612f2f6789e4dbdd4efc053fa29fc1fc5b
- SSDEEP 6144:AicFyQyEBErg9v0jhbq9IBszA6xXu+Mh9rdRYjZIdLgliE:rgEcx0jhbq91nxe+O9rdRY+6r
- TLSH
  T1F974F141B780A667D5F14E7359A7CB725372AF754702470BE394732B3EF22839B0A288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery downloader agenttesla guloader keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH
  T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- TLSH
  T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6