Severity
Medium
Analysis Summary
A new AgentTesla campaign is seen targeting victims with malspam. AgentTesla is known for stealing data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. Agent Tesla collects personal information from the victim’s machine, steals data from the victim’s clipboard, can log keystrokes, capture screenshots, and access the victim’s webcam. It can kill running analysis processes and AVsoftware. The spyware also performs basic actions to check whether it is running on a virtual machine or in debug mode, in an attempt to hide its capabilities and actions from researchers. All the data it obtains is sent in encrypted form via SMTP protocol.
Impact
- Credential Theft
- Data Exfiltration
- Information Disclosure
Indicators of Compromise
MD5
- b65683f61583532ca2de86c17ff8e501
- cd4cc9b78f593943aa5186d34a43a76e
- c299b411c8a7c8678fe4e6a0eb2b0222
- 7bda5add0d4ba2c5b1810e9f44a6c6fb
- 329debbda9174757ac0678b3cb364e19
- e6ae1eecfc38431cb3bb85907f7aa8a7
SHA-256
- e729a9475fc9de021d5f141593ef37a929ccc0e27ea00da8fb42ed856f6d4caf
- 73f021d253821e0fd2a2f4f619eba982b20ca11f323a44bee488cba17a9b3876
- 92d1c4c5a8d8b6bcd0a1dfa5c8331578c55f911eb5852e6f9524aea02f407423
- ddfa7fe7c01cfa34c2413acc83e9f11eace8bc09e80128da2b5e2e61284df9ff
- 2481629865775bb320d31a4ddb9bc9e8fccd5210df7006af7dd7bb0901e7510c
- fe0bbc374216e1388b03e36ff22be282e253dff850f60040e795379033e68d7a
SHA-1
- 2c2bd257425a75f4ed5c453b55f55553f6a74926
- 4d8b097402c1719dcd9e54c6ff2f4ebf5723cb62
- d5c7dc1c09c3a4ad3e4f1abac29c90697b30ab16
- 857ec2f81068823ea37da355fa8fef8396230eac
- ac81ed9f7188748eae725ef7727a7c0489e03cd0
- f76e5c488bbd336c9335294dfb31ad7a8878ae7b
Remediation
- Block the threat indicators at their respective controls.
- Do not download files attached in untrusted emails.
- Do not download files from untrusted sources on the internet.
- Search for IOCs in your environment.