agenttesla | cd959e23ebf9d8030a8c754fbbfb69fa648693f2fe9279af4904cf65d66310e4

General

Target
Fattura proforma.rar
Size 1.3MB
Sample260831-lv7baszbje
SHA256 cd959e23ebf9d8030a8c754fbbfb69fa648693f2fe9279af4904cf65d66310e4
MD5 00a33766c95d31bf4f7ff2bc49fb6bb4
SHA1 41a0797737b1c8263deb1263dd660b9cd2b81f6b
SHA512 ff7836c74c33ab72cdcdae4feef0de70066a96992537815ace7567a213300cf292c77f1c340a82a36b4e58fdc6bc956cadfb7dadfbdf27470ab3bdfaf499384c
SSDEEP 24576:XUuxfpnDwvhe02QzZ5U6egdK/i/iGgcN2BwYYxCjZz5twYVO:EuxxDwv9PU6DPBNmIkF5JVO
TLSH
T1475533A7EC58A96F6DBF364FD65288965DE7724C11CC801C0ABDA71FF2B4B000CA24E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.piovau.com
Port
21
Username
[email protected]
Password
OnyenzeNK123456

Targets

- Target
  Fattura proforma.rar
- Size 1.3MB
- SHA256 cd959e23ebf9d8030a8c754fbbfb69fa648693f2fe9279af4904cf65d66310e4
- MD5 00a33766c95d31bf4f7ff2bc49fb6bb4
- SHA1 41a0797737b1c8263deb1263dd660b9cd2b81f6b
- SHA512 ff7836c74c33ab72cdcdae4feef0de70066a96992537815ace7567a213300cf292c77f1c340a82a36b4e58fdc6bc956cadfb7dadfbdf27470ab3bdfaf499384c
- SSDEEP 24576:XUuxfpnDwvhe02QzZ5U6egdK/i/iGgcN2BwYYxCjZz5twYVO:EuxxDwv9PU6DPBNmIkF5JVO
- TLSH
  T1475533A7EC58A96F6DBF364FD65288965DE7724C11CC801C0ABDA71FF2B4B000CA24E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  Fattura proforma.JS
- Size 3.7MB
- SHA256 f5509b65f68b27aaaebd6dfcc5dee9e4110737797fd19137d20d222d335ac2b2
- MD5 5c8ba168f3e18a809d77e9bdd32ac426
- SHA1 d20aa7a8e48fdbae96ef848741598b9c4fd8227b
- SHA512 d8de1891d9fd12710f0c605cb5904007c32483c0d350b6ab311241cb9a6522459d91d35347c2e7be5a48b0d7eccf18ca35438d6aa69b825e2df9200375813b54
- SSDEEP 98304:QBhcgEkSLIwWNb7oLP+gQhF+Z1C1DRQ4oey26VevEfoKrp6o:QBhcTdEw07wP+fqU2OAyE1p6o
- TLSH
  T1E1061D891F495F32B638971C417F8AA09439630388C5CB393368F939FB1CD875B5A9DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla donutloader keylogger loader spyware stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4