agenttesla | 33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6

General

Target
33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
Size 343KB
Sample260810-slj8qs1glc
SHA256 33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6
MD5 9a765f1c66677f75071b26ae2487b1d6
SHA1 2084f98c0a2055684b7db1063006057117e4840f
SHA512 ad656841216bfa644fb3f958ef7c9cb37fa1791b30844319bb3be278d094f535e892692e6e0c1365ce774a13e706d151b2818aebd7bf6f3b9adab184cdb738ef
SSDEEP 6144:KxFS7C/noG9vC2+J3xSfHcjrZBXe2xkESEglIQ3yBwKIeeJP:MeAnoGhC2+V4fHcjNJfkESN3yq
TLSH
T1527402A37351E443C5600774597B8F20F7E5EC686A87275B2B80BFAD7DB32C1AE0A251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
wcEwu}VSh(pAItLY

Targets

- Target
  33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6.exe
- Size 343KB
- SHA256 33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6
- MD5 9a765f1c66677f75071b26ae2487b1d6
- SHA1 2084f98c0a2055684b7db1063006057117e4840f
- SHA512 ad656841216bfa644fb3f958ef7c9cb37fa1791b30844319bb3be278d094f535e892692e6e0c1365ce774a13e706d151b2818aebd7bf6f3b9adab184cdb738ef
- SSDEEP 6144:KxFS7C/noG9vC2+J3xSfHcjrZBXe2xkESEglIQ3yBwKIeeJP:MeAnoGhC2+V4fHcjNJfkESN3yq
- TLSH
  T1527402A37351E443C5600774597B8F20F7E5EC686A87275B2B80BFAD7DB32C1AE0A251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
- MD5 792b6f86e296d3904285b2bf67ccd7e0
- SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
- SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
- SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
- TLSH
  T140425A0583618EF3F5962D3C00667E2F2B79BE3416F140639FE34481A99A1CFA975392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
- MD5 5aa38904acdcc21a2fb8a1d30a72d92f
- SHA1 a9ce7d1456698921791db91347dba0489918d70c
- SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
- SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
- TLSH
  T1A3D1D53A2AD12DF3D14889702817793B8BB9D8360F604650DB6B1AE535E5CE7DB3038B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6