agenttesla | c84803c2c2e9fc2ba2185c5f90da3369a413478a31dbf74edda7cc3b9693918f

General

Target
08082026_1403_07082026_Transferencia de pago.pdf.rar
Size 421KB
Sample260808-rc1cxssshw
SHA256 c84803c2c2e9fc2ba2185c5f90da3369a413478a31dbf74edda7cc3b9693918f
MD5 f12832aa8f643808f90caabd368ae483
SHA1 cf027a720eb266d591a4965dce46e8379280a889
SHA512 1fe24c4a21247d05d10d41350046c37c8ce3acb57301c012b9de8620234f0a7a8a19df15e29a686a75b42438f62cd07d8563e02e76c7c54a57156fb2b265b2fa
SSDEEP 6144:oawvm/q6KBcDVPAcoUZpoTudrW+eFlpTq81OSpm1tUuuHTuHr4uEY:2mCaJASqTAW7Fi8gztUuNr4uEY
TLSH
T1789423AE29241A0538BD153BB7AD1C83BDFF682ED943D702B3A316825752FC87B52315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.dankely.org
Port
21
Username
[email protected]
Password
!?jSK$}v08$[

Targets

- Target
  Transferencia de pago.pdf.exe
- Size 531KB
- SHA256 62c5d6256e1ad8652c9b3dda022da47454532eb06b14c70c887f9a94b7165b88
- MD5 47a9196fcef7d0220b6f859bfccb8c71
- SHA1 d3e9ae3f030c4610836faee6cac646e090938670
- SHA512 dc72538c1a33885777e553cc282ce5a28b335e3029baac4c32fab40077359d6dabb79b80a24c6e4434e7d69d9b38b47490743b28d01a85effed6d395977cf78d
- SSDEEP 12288:zMwZJjAUKCPVJ+2UYKmzS5VrLhlv+W6sRO8lnRlM:zMwZJjpKCb+2UY1Off/GQtdRlM
- TLSH
  T1BAC41292F3806091DD7246322877EC7217FB3D7EA079160B3264B33A3DA90B2655B65F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4