General

  • Target

    AgentTesla

  • Size

    965KB

  • Sample

    200709-95dpk1vfnj

  • MD5

    10888cbc0356d7ed153c9d646e650b67

  • SHA1

    fe0d31a7ee4cae23de596186512c6af1310ead4c

  • SHA256

    df6e5a970596d544e6f644924cafadda5a596e2337621ea98829bd36801fa02c

  • SHA512

    a64b4b9e5525a6c609d1eac830a25d7d95e3ab9b6c9374130728bbdd8ddd492676cb8bb60d39139aadf18e8f7adf715d222b5596d7df601b8317cda78dc335c9

Malware Config

Targets

    • Target

      AgentTesla

    • Size

      965KB

    • MD5

      10888cbc0356d7ed153c9d646e650b67

    • SHA1

      fe0d31a7ee4cae23de596186512c6af1310ead4c

    • SHA256

      df6e5a970596d544e6f644924cafadda5a596e2337621ea98829bd36801fa02c

    • SHA512

      a64b4b9e5525a6c609d1eac830a25d7d95e3ab9b6c9374130728bbdd8ddd492676cb8bb60d39139aadf18e8f7adf715d222b5596d7df601b8317cda78dc335c9

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • AgentTesla Payload

    • Executes dropped EXE

    • Modifies AppInit DLL entries

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks