agenttesla | 2b53db8f2a67b954f4e120dbf03fbac62edbcad4438141416d2b3a18c90ee249

General

Target
purchase order.rar
Size 485KB
Sample261001-llke6stcrd
SHA256 2b53db8f2a67b954f4e120dbf03fbac62edbcad4438141416d2b3a18c90ee249
MD5 c7a17f54a2229f3294be0b95bafb87e7
SHA1 652ba214bb741bdde6a9b79f7ccd7c2c3c77d849
SHA512 c11daa603988077ea80702143d59204416f7c85be9196f01d0b212d04e2a2f3613b840156db5e776fdaf5fdd12ad5a17c52e5c6ec7b3fb7170429512cb86fcaa
SSDEEP 12288:hkHdOO3sqybUnq9YZ+TvHYvbSE5Qy2B5VqBQ:hkHdBcoq9YZ+TYX5Qy2B5VgQ
TLSH
T168B423CACC3DA09885B42C4F95A17DF760C61F50F86C1F8CA991495492BD0B9EE3A4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  purchase order.rar
- Size 485KB
- SHA256 2b53db8f2a67b954f4e120dbf03fbac62edbcad4438141416d2b3a18c90ee249
- MD5 c7a17f54a2229f3294be0b95bafb87e7
- SHA1 652ba214bb741bdde6a9b79f7ccd7c2c3c77d849
- SHA512 c11daa603988077ea80702143d59204416f7c85be9196f01d0b212d04e2a2f3613b840156db5e776fdaf5fdd12ad5a17c52e5c6ec7b3fb7170429512cb86fcaa
- SSDEEP 12288:hkHdOO3sqybUnq9YZ+TvHYvbSE5Qy2B5VqBQ:hkHdBcoq9YZ+TYX5Qy2B5VgQ
- TLSH
  T168B423CACC3DA09885B42C4F95A17DF760C61F50F86C1F8CA991495492BD0B9EE3A4FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger persistence privilege_escalation spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2
- Target
  officlogs_ritubohara.com_093026pgpn.js
- Size 691KB
- SHA256 c4dd621b13407af995b5989f7287f8500339fc83e50ddc26f6f669596213a5f5
- MD5 f5585e9ce0a3483aff800dce458691a2
- SHA1 aa4ad2a9277d6af9fe3fad76eecddbc80442eafc
- SHA512 18340ff2eabcf95da73b10b2ff6f640e81cc734a144d321e5047c14bd63e533dc3eb93cb5529a8716eb862395e4c92228fdcf68be7a17ae17c8771cd28cdaa32
- SSDEEP 12288:dOkytMY2Y5G/sqSjYDTdfrCOv6udK2h6Psg6SHC9l:dOXz/wsqCY35Cfg/h6Psg6F9l
- TLSH
  T164E4DF372126293030B81A5A0E3F36A007F978D66788D8A4D15DD7AC3276D8BD5F7CE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger persistence privilege_escalation spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral3 behavioral4