agenttesla | a52942c3c97c45003c59a32665b1d8db78c941a1cbdbdf294cb1daec2ed0b590

General

Target
27082026_0059_26082026_Nomina_Agosto_2026_Recursos_Humanos.pdf.tar
Size 181KB
Sample260827-bb663sga22
SHA256 a52942c3c97c45003c59a32665b1d8db78c941a1cbdbdf294cb1daec2ed0b590
MD5 ed5917589f772a5661646996638ebe8f
SHA1 6cda82925a70215492cd44874b230e8a30fe317a
SHA512 13c3f9b51b5d7f26fcdf15f0b6baf4badd64c16ea200d91a4cebbbdc0c9222867315dc69474ad775b31e0bdd5d229696a4c67e588340b42d9cadc130872127ef
SSDEEP 3072:nm++H01fvF4Dbt29YUtiuAQIWcpAJidS2sKcyZhA2aIKV05xoJWenJxfXBYRChG6:f+H2fWDbt2/XAQIWOGsWEKCPpeJxdht
TLSH
T1F5041232C29EC235AD8F50F924AD5652778ACABB793C928FD94DAB17B540FDD0401732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.dankely.org
Port
21
Username
[email protected]
Password
!?jSK$}v08$[

Targets

- Target
  Nomina_Agosto_2026_Recursos_Humanos.pdf.exe
- Size 218KB
- SHA256 1de0fa738e7cf0b9cf92e509dd72dd50fa5d8e4c74f770f629be3c69e77fe740
- MD5 818aeb0c3f6b82e285cd1bd0ad5d90cc
- SHA1 545e9dd43e4f91c6b7445c57b0920b87064e77c3
- SHA512 16be13acc18537c19b65c819c60edbf40f15dcf605fdef85411f792191016dbf34baf6040df8b8189ee12f48351c25b4497adbf5e6c0664c35b72bd739e4588f
- SSDEEP 3072:YNRCywDw1DiJkuqh1ZtgZWQ2aVnOAlRo8FFgJgZ3TKKt4ExOPBkFYLaKSGvAZCbX:YT4DteltgZWQ2aV9aU3XLxuk6La+kCbX
- TLSH
  T11624D001B216C516CEA046304D12A6AF5AB19E693D309B3F0F30FE4BBFBAEC35815759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
- MD5 a1da6788aeaf78ca4ae1dece8019e49d
- SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
- SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
- SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
- TLSH
  T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4