AgentTesla Deep Static Analysis (75ab1254) | High Tehdit

Derin Statik Analiz — AgentTesla | Tehdit: high

Dosya Kimligi

SHA256	`75ab1254bcb71bceafebf3297dcd931f991baf587a9690686b644407ea938468`
MD5	`5ce7c1223195b2f892fb86e6cfc3bb89`
SHA1	`d86d6018d4bd3142a8d7c0e4c51d0c8c9c3695ea`
Boyut	636821 byte
Tur	/opt/ksentinel/samples/5a505f489d40c545ddacf31c16898cc85d6cf4bb308ff8448e24bcc74
Derleme	Bilinmiyor
Packer	UPX

C2 Adresi: Sifrelenmis/obfuskeli config (statik analizle cozulemedi)

Yetenekler

Tespit edilemedi (obfuskeli)

Gelistirici Ipuclari

PDB Yolu: bash: -c: line 1: syntax error near unexpected token `|' bash: -c: line 1: `grep -oiE '[A-Za-z]:\\Users\\[^\\]{2,30}\\[^

Telegram: @0ND1 @771I @8rEW @fgqS1 @ha11

PE Analizi

Binwalk / Packer

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, encrypted compressed size: 63

Aile Tespiti

String kaniti bulunamadi (sifrelenmis/obfuskeli).

AgentTesla — Malware Profile

AgentTesla .NET credential stealer. JS dropper @version 8.16.22. Sayısal obfuscation v6034. SMTP FTP HTTP C2.

Malware Type

Infostealer

Programming Language

.NET

C2 Protocol

SMTP/FTP

Target Systems

Windows

Also Known As (AKA)

Agent Tesla

Technical Details

C#/.NET, SMTP/FTP/HTTP C2, GetAsyncKeyState keylogger, browser stealer (Chrome/Firefox/Edge), email client stealer, FTP stealer, VPN stealer, clipboard monitor, screenshot

Attribution / Threat Actor

Turkce konusulan gelistirici 'Turk Hack Team' ile iliskilendirilen ve Turkiye'den yonetildigi dusunulen platform. Pek cok farkli siber suc grubu musterisi bulunmaktadir.

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC List (5 indicators)

IOC — AgentTesla

# 
d86d6018d4bd3142a8d7c0e4c51d0c8c9c3695ea

# SHA256
75ab1254bcb71bceafebf3297dcd931f991baf587a9690686b644407ea938468

# MD5
5ce7c1223195b2f892fb86e6cfc3bb89

# FILEPATH
bash: -c: line 1: syntax error near unexpected token `|'

# FILEPATH
bash: -c: line 1: `grep -oiE '[A-Za-z]:\\[^\s\"'\'<>|*?]{5,150}' /tmp/all.txt | grep -viE '(msbuild|nuget|packages|Microsoft\.NET)' | sort -u | head -10'

Type	Value	Note
	d86d6018d4bd3142a8d7c0e4c51d0c8c9c3695ea
sha256	75ab1254bcb71bceafebf3297dcd931f991baf587a9690686b644407ea938468
md5	5ce7c1223195b2f892fb86e6cfc3bb89
filepath	bash: -c: line 1: syntax error near unexpected token `\|'
filepath	bash: -c: line 1: `grep -oiE '[A-Za-z]:\\[^\s\"'\'<>\|*?]{5,150}' /tmp/all.txt \| grep -viE '(msbuild\|nuget\|packages\|Microsoft\.NET)' \| sort -u \| head -10'

AgentTesla — Go to Full Profile →

C2 Servers (8 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
digicert.com	domain	—	TCP	active	—
stem.ru	domain	—	TCP	active	—
digicert.com	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
dublincore.org	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
googleapis.com	domain	—	TCP	active	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.