agenttesla | 3b24496e333b1b4f77639378b6277fb93b1aa9ee25ae6301d48e2404993fdf07

General

Target
3b24496e333b1b4f77639378b6277fb93b1aa9ee25ae6301d48e2404993fdf07
Size 1.6MB
Sample260826-bt2z3s1dpf
SHA256 3b24496e333b1b4f77639378b6277fb93b1aa9ee25ae6301d48e2404993fdf07
MD5 1d07b8122a96188c3e772e81f6d0d77d
SHA1 c822c747123255a9584aa0239934c1906edbbfa3
SHA512 a8955f7a0d4c58507d27094f4a64cfe6ebeafb19b6dde9795be8dbf7585e94f57d2bed4dd890450d8213dd0f2498244ed498b7114e2456c743629e5bde327a80
SSDEEP 24576:wocvD0sZCvJFoQu1qkFkd5KSNlVDD5lHljl7XmcCsDaVomAoKkcIL46u23oX7TUx:PcvEFoQgfF4f3HdjJblIA3kccc7g4WAk
TLSH
T10575339EE9C645CBF27B0B7B323B704B05B831B48BFE214A974D1517690F86E2D5188E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.bookingreg.fit
Port
21
Username
[email protected]
Password
ARu);5UMHp+Qve]A

Targets

- Target
  payment-pdf.JS
- Size 4.0MB
- SHA256 f68ef6e15f326e24326fdb3ab382ee31c39fde496bc025c5582c91833e207cf1
- MD5 9bb29b581283a0871739a743968e5fa8
- SHA1 9972bb3420b3e3adf75a04c4b124453fea3ec461
- SHA512 7fc844919f74a98ce80ea684a1ae6b833d31b390df6d32d0ad02eba44cb93537c6394e79cb0df5180783ea1433b9fead7582ffa63863882eeccef0e122b778d6
- SSDEEP 98304:2iU+V9dhVYF4Zi4E18XLidNMZTNjcrTv1tZ6+NIPiDhfBIJ31DV/dm0kW9bBY:2iU+V9dhVVVedsT2r5NpILW0Le
- TLSH
  T1D31693A11BB59271F628774F59B69D209C29118B00C5DB033ABD8D1CFBE4A27736C9E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2