agenttesla | bf044bf9a623c0b6aa595b553421bf7ab67441f078476a8b773a197991628b05

General

Target
30092026_1046_29092026_RFQ-QUOTE-D62 PR 1009591376.GZ
Size 535KB
Sample260930-mt8nea1brh
SHA256 bf044bf9a623c0b6aa595b553421bf7ab67441f078476a8b773a197991628b05
MD5 03e3966eaf197d88d54b5cf1b438a378
SHA1 3d1d72c5a95b7bc28d04476b17468482f00b8d8d
SHA512 0060a654d713330342fea540b9a25f148faad71f0496416e3d4bcfc31d69c585a4b32f3e3a45dbd3fef6497b55c3cac3c9e0a615370f2e5bbbe7d0af73f0000a
SSDEEP 6144:sFvHaqog4SDf0/BuM8rKS932ZH1olFr0D+0xKFdQk6gwPTXy95uq7GwebcA1DVtP:sbVf+Fmvo3GwPTXs5uhLWVg7xjWo/V
TLSH
T10FC42313D267DC4B5C9B900EDF9E58BC4827D56A0B8BF7068A004F9DFD87356131A8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
s4=O8tsknbClU8b_
Email to
[email protected]

Targets

- Target
  RFQ-QUOTE-D62 PR 1009591376.MSI
- Size 564KB
- SHA256 c571da34ec2edce2816ff4092ab21abc6250a6c410ee1f54586f2170a2d5010f
- MD5 1e92dfdabae073364ad634f7b5f3d365
- SHA1 96b89670e9ed749327fb4b3ff114d320ec86180b
- SHA512 ccbade66dd2d241613c3bac9f264fe660b9536adb5e86863f407353aab175f5245d223dc2fd9424c728bc9b65919bdd52709b791da18154faf387c13ce82a845
- SSDEEP 6144:mFG6Ug4yDf0/Bu08rKS932ZH1olrr0D+0xKZdQkOgwPTXy95GqJGwebcANDVtdnS:mQUHf+DmpodUwPTXs5GlL6VUTxjWD7
- TLSH
  T138C42313B3629827D8534736CF9F4AF80E37AC660757DA161A05BB9C7EB315103268F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger persistence ransomware spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2