agenttesla | d5e8fa1f1a4b3e2aabb4f7b8e2c795b380703474be49e27928b69778153e274f

General

Target
d5e8fa1f1a4b3e2aabb4f7b8e2c795b380703474be49e27928b69778153e274f.exe
Size 669KB
Sample260910-ndcrgav1ht
SHA256 d5e8fa1f1a4b3e2aabb4f7b8e2c795b380703474be49e27928b69778153e274f
MD5 47f3ce7738a7a1e5bfdd668a3f4e4b77
SHA1 1406c0b27cbb8d9b4d50e4eef4d5d1992a8fd566
SHA512 2814f3736e82c160b59787eec55ee7a8ace7ff55fae0b834d5c7a2a4cf4c1c7c06cfe3eae9cd256ff291ea766443aedf5d1a9d2c8d6abf51e8fd80d6ce45a954
SSDEEP 12288:EMwOfepFzYAM+T/cCa0BNNNetJd3SfDgPoTMYQrHIY:EMwuepB3M+j3NSJd3WWTN
TLSH
T1C6E42350B391F02BC9FBA737DA1255F96DA94E11C5520F130BAC3F1D393ABA26826371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.holzbrenzii.com
Port
21
Username
[email protected]
Password
@lilkooll123456

Targets

- Target
  d5e8fa1f1a4b3e2aabb4f7b8e2c795b380703474be49e27928b69778153e274f.exe
- Size 669KB
- SHA256 d5e8fa1f1a4b3e2aabb4f7b8e2c795b380703474be49e27928b69778153e274f
- MD5 47f3ce7738a7a1e5bfdd668a3f4e4b77
- SHA1 1406c0b27cbb8d9b4d50e4eef4d5d1992a8fd566
- SHA512 2814f3736e82c160b59787eec55ee7a8ace7ff55fae0b834d5c7a2a4cf4c1c7c06cfe3eae9cd256ff291ea766443aedf5d1a9d2c8d6abf51e8fd80d6ce45a954
- SSDEEP 12288:EMwOfepFzYAM+T/cCa0BNNNetJd3SfDgPoTMYQrHIY:EMwuepB3M+j3NSJd3WWTN
- TLSH
  T1C6E42350B391F02BC9FBA737DA1255F96DA94E11C5520F130BAC3F1D393ABA26826371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
- MD5 a1da6788aeaf78ca4ae1dece8019e49d
- SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
- SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
- SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
- TLSH
  T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4