agenttesla | c09cdcddef7d7348dcf307fb4ebef72f04bbdc83dbbbefab4c11dd0e8709535c

General

Target
31102026_0559_20102026_COTIZACIÓN #0211839077251025.pdf.lzh
Size 683KB
Sample261031-gp15wavsdv
SHA256 c09cdcddef7d7348dcf307fb4ebef72f04bbdc83dbbbefab4c11dd0e8709535c
MD5 2a11a9a14ea23fa960362ede767554b3
SHA1 028a61f265ecad7cb64a1a7503fddc9fa47528d7
SHA512 323bb7d131ea29f537489b1da6daffa472b1cb84efca603c85f74e764aefaebc5bc5d9dd5156b8884339cde4670ace5467578dd8cddaf046d76d728dbad75a48
SSDEEP 12288:HpSVYTJJf2YzNQky1GofpZzd/oJgiCTurRjg3Uer3KFR6227BDTXzCd2:AVYTJNhSD1/dQqitru3B6FRNoDTDJ
TLSH
T118E43372331B9B6A8CE4271B4523196D33D8AA63CB5BE1D5CC5845F3BD6711B83CE02A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.hermosanairobi.com
Port
587
Username
[email protected]
Password
~ DLJ099+efQ)F78ui890l!~ // ~
Email to
[email protected]

Targets

- Target
  COTIZACIÓN #0211839077251025.pdf.exe
- Size 827KB
- SHA256 80f45e6c96776d9b2e56b6fd78232e5325660a80cdc94232a7d72375df5f9196
- MD5 081759cc67cdac05a0650ebf8da8fe6d
- SHA1 20d9e7b0e328c35f4defffa6d06d1105148b0a2b
- SHA512 9c076ae0b5f1c69ceeb4aa79ce92298a6184bdba38ac09632d682b6790a3980d5606e7645b5f79f49fed693625221d60d6debc465c04421392ef933dca8c869d
- SSDEEP 12288:PQ87RVH/4peLMIYCw4l8w80RpQF0NoDBIHBL3SIGfinVV5W3fRN1upXzqU845K7:lVH/4pa9zyhuNQIHBLI+G3oBqU8d
- TLSH
  T1A505F1D2F441C0B1D8E9C971682BBDAF0F3A7D376E74505A2644BF8D39BA16A41F2207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery agenttesla keylogger privilege_escalation spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH
  T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- TLSH
  T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6