agenttesla | d827b5fb83f5828d0bf062270bff295e1e70644d324459a43a322b08fe341ac4

Resubmissions

08/10/2026, 13:32

261008-qs5rxafa8310

08/10/2026, 13:24

261008-qnrz9azs2l10

Sharing

Copy URL Twitter E-mail

General

Target
41139fff-4912-56e2-8992-2839448c2a4a.eml
Size 1.5MB
Sample261008-qs5rxafa83
SHA256 d827b5fb83f5828d0bf062270bff295e1e70644d324459a43a322b08fe341ac4
MD5 3e93ff6599f22425c978a8a60d5bef1d
SHA1 432bf5a95bc6fa6f070c0f5486c28a0fce5e110e
SHA512 e342ac6603c9d1f2df09ae778d923d8322a96a90d49d7ff92e1aa1f4bd7c612e77c673344ba91d92e71f23245fa8acf7dbc9f521ef13d8ccfcd913efbf468ec8
SSDEEP 24576:kzXRfNUJzVioyEn/9QMc05fxryNy5ZRsqIwwcRTNiOVMfEu2gpp4h5MIVa:kzXRf0Dh359yNyqqIINnMHPIVa
TLSH
T1E6752316EF880599891BC6F1B8477A783AFD02C75F520A3203F9873D31ECDA986D2B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.avion.com.sg
Port
21
Username
[email protected]
Password
TS+]ZhAsYWKb

Targets

- Target
  41139fff-4912-56e2-8992-2839448c2a4a.eml
- Size 1.5MB
- SHA256 d827b5fb83f5828d0bf062270bff295e1e70644d324459a43a322b08fe341ac4
- MD5 3e93ff6599f22425c978a8a60d5bef1d
- SHA1 432bf5a95bc6fa6f070c0f5486c28a0fce5e110e
- SHA512 e342ac6603c9d1f2df09ae778d923d8322a96a90d49d7ff92e1aa1f4bd7c612e77c673344ba91d92e71f23245fa8acf7dbc9f521ef13d8ccfcd913efbf468ec8
- SSDEEP 24576:kzXRfNUJzVioyEn/9QMc05fxryNy5ZRsqIwwcRTNiOVMfEu2gpp4h5MIVa:kzXRf0Dh359yNyqqIINnMHPIVa
- TLSH
  T1E6752316EF880599891BC6F1B8477A783AFD02C75F520A3203F9873D31ECDA986D2B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware spyware collection discovery execution agenttesla donutloader keylogger loader stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  ThaiHC00202608102026.7z
- Size 1.1MB
- SHA256 dd4f17b26e1557a7a81315204eb2518adb6374922c7cdc18a0a4164338e5b453
- MD5 4073ee90fdfecc63ec7edc0dea137127
- SHA1 86611ce124d525bdea72aa9485506fbfc35aa888
- SHA512 a3083598d22a205f9f0e4535b7fdec30a8f14eced67abe1ee72e9f931992b9b22c7cf4a32e8b97b5748c31d31633d7e461ac5262ce579c6980d89aedcaf2ac21
- SSDEEP 24576:GKg+IpluCDCnciOIi8E16aGTdnIBP5snRz629OK7q:GnluCDp8E16a2IBsRdzO
- TLSH
  T1D235336BE41063AEF03BC25529F44325E3940B536D8FBCADC8577981B237437AE9CA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  ThaiHC00202608102026.JS
- Size 3.6MB
- SHA256 2be27ea105703cc8a85aa0122b96067b5c1b102782419ec8a45fb779c117eafd
- MD5 fcdb93c83374d18528d0734cd6b2538a
- SHA1 7fe550b5afefaa87fd00231cc6fdd4bd163f7e32
- SHA512 bc16abe560ff0dc8e674892b79af1a04733da89d948ed2ac6349f926b82f080c08ea3c508d3c044f8fd49d2ce20ad74077209ffbf2117f9e10d35d059a58268f
- SSDEEP 98304:0Tr46/ATaejeDy9PYULgC9VCt6Vd/k3cJLfvQqefBSfMd2Qo:0Tr46/dejeGxLgCd/k3pcfMA
- TLSH
  T19106936823A047B67FE0DF5F8136E9658609581372D0CBAE30DCF116B79DC0B2399AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla donutloader keylogger loader spyware stealer trojan adware persistence ransomware
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral5 behavioral6
- Target
  email-html-2.txt
- Size 17KB
- SHA256 dcd2d2738b33a3d55c5edae6f4269b7ab370cfa365ec54a2ea96e040518c467d
- MD5 2cace2179f1a97fb3fd4da726bc15d36
- SHA1 f0ae389e8874d4b7a4b1d25dc3030827c3aca1ea
- SHA512 c4201e9c325baa43a7e2791dc60bb7526c11a31302e78b72e2a8511e3653ff7a678b8fad5601e0a9172bccad67f276d80d4bfaa805fddffa3ea0209f6dbdb5df
- SSDEEP 192:Gx2PUx2Sx2Bx23Bx2QGx2qOBx27TiD6oUoNoMocMo27MoR189w:G7BmOTc7OTr6ryoMbMb7MuKK
- TLSH
  T1B3721E47F2D00901ADAF4C60A457377E3A3C86C79B664C7469DA3B7F5A8CCE286C1399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  email-plain-1.txt
- Size 627B
- SHA256 31554cdfc2e07583f8a0541258c1ba10c73ca1fdd86d8728946870f22aaa4b15
- MD5 6c775a8a688372f0592af30453ac5b15
- SHA1 07a3a295bbeff48b14d1e4e66fa6726950f35b71
- SHA512 edc45400057861abbab1629a77731b64bbe3d281e82bd4005829326d4afc241b7636e5d67f4446a89787f2a07b7bd1f8786faaeeb83f047affd4f863c100b63b
- TLSH
  T1AFF0DD8EE7632615134A10507A4B25A0FA86842CAF8490047469E20D72A26DF2B268E9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  image009.jpg
- Size 15KB
- SHA256 42a231d03d9fbf83a2af7b0419b05a635b49452dbd4b884ce573f81b4b380091
- MD5 df6c5c2753efae21a810d586ef0701bd
- SHA1 cab0ec401c2a3cba59868bceda2a4353798f6f83
- SHA512 88b9e18b7df7c32d4ce34ef57ddb4ea8b815bb3d9422e677a6ca953ab516813c6e6371d60a53f2de1318d9f3a5cac101c85d8e6d135060ff28bdc25e45e8a5d2
- SSDEEP 384:pFbdApgx4WE76hgC2I04JyK0h8mfdOkUWfHV4L/RpDl:pZdmgxymXNt8K02mGi2L/Rll
- TLSH
  T1F062C0F52BB35198E11C99F378A59793F335AC123CD08638F4EBD1D564C288AC36845D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12