agenttesla | 51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458

General

Target
51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458.exe
Size 291KB
Sample260910-rpnvnavcqb
SHA256 51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458
MD5 3a0e80415e7e1f49ee3bd7912832f3c0
SHA1 b3233de7e91adf25c6dddecdaffc1eb6d2e6b43b
SHA512 5b99dba9b593f011be2a2ec6ddddf54930a547f3c316fec5d355930b6e8ebce7d84040b0a8be8ae6204ed876afa1220c5e48c5e2308c56dc0ce02db441703741
SSDEEP 6144:aNDlOYY223pe1bvBhZXnBMaV94fWfdjFPQcPMH:aw3pe1bvBnuWtFb+
TLSH
T1E354CF1767379C12F9BC7170A6E7D57217781DB6212CB42222D0FE1738B677A2A0D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.gantelopex.com
Port
21
Username
[email protected]
Password
tx}m!L+75oV^

Targets

- Target
  51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458.exe
- Size 291KB
- SHA256 51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458
- MD5 3a0e80415e7e1f49ee3bd7912832f3c0
- SHA1 b3233de7e91adf25c6dddecdaffc1eb6d2e6b43b
- SHA512 5b99dba9b593f011be2a2ec6ddddf54930a547f3c316fec5d355930b6e8ebce7d84040b0a8be8ae6204ed876afa1220c5e48c5e2308c56dc0ce02db441703741
- SSDEEP 6144:aNDlOYY223pe1bvBhZXnBMaV94fWfdjFPQcPMH:aw3pe1bvBnuWtFb+
- TLSH
  T1E354CF1767379C12F9BC7170A6E7D57217781DB6212CB42222D0FE1738B677A2A0D28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery downloader agenttesla guloader keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH
  T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4