agenttesla | 22d10b28f4769f2121d624f5b4428b7fd794c3ebf6cc16e9183f3a48a71e4af5

General

Target
22d10b28f4769f2121d624f5b4428b7fd794c3ebf6cc16e9183f3a48a71e4af5
Size 1.9MB
Sample261102-bvg2aset31
SHA256 22d10b28f4769f2121d624f5b4428b7fd794c3ebf6cc16e9183f3a48a71e4af5
MD5 6a28738acab7083c92ea316c53029f1c
SHA1 e8a67029e40755b091ca947a53d9e6393dd511fe
SHA512 91596593a6929e219470ab64c28206f2c422c310608e6e02409844d599dc87527e388c83911a121fbcb70ddec56311431c4aba18e277792a9b04ec0aa063200c
SSDEEP 49152:tm+azUsZEvwmwyliR17WSi2Ehdg0MMjbigpnXl5:tmI/w9yK17WSiVhdgjYbiAXl5
TLSH
T14D9533CAD95AA605F4E537307DE5B0B20D4075FE22A7B2B8F2E7947B1166F352C2013A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.bswcsz.com
Port
21
Username
[email protected]
Password
)AO^#+8luIUu@^2I 3

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.bswcsz.com
Port
21
Username
[email protected]
Password
)AO^#+8luIUu@^2I 3

Targets

- Target
  Original Shipping Doc.pdf.JS
- Size 3.4MB
- SHA256 37c1e390e88ccb231277a08fb768295109f29582efdd06f1b23e07dfbbd1670d
- MD5 0b3dc4155cbd34d81a92b744985cb5af
- SHA1 2106f8e91da0350ca82d2f83e4381933e315cd40
- SHA512 223fff0a5b3128975007ab7b255a7848828ffbfa8fae95a94946ce639fa2efa13327730429de527405485ea7189c479f1de555b8c55a9edee949887066745a40
- SSDEEP 98304:VzoCl3PN06yMWil8ZyVJbqnoGn2YGh3xPk3UuEg8UAQ1tZiEBPZpvCbuafm:Noo8ilSyjb+bGhNvuEg8uvCba
- TLSH
  T1C8F55A4C5173F7B6E4780A6C8FDF1B920A29AE77FA53D83363245EAA5744BDD3218204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution agenttesla donutloader keylogger loader spyware stealer trojan
- Detects DonutLoader
  loader
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2