agenttesla

General

Target

IS099853EDCOO.com
Size

951KB
Sample

200713-rjh1e9dvxs
MD5

4c8cc9b59cce6e95f78f11b135748bd8
SHA1

cdca3d36f7424f97029425a89f5921afe6c3dcb7
SHA256

33719edd73278cc289278960c045181c39d5c0c1b3b101a2009946473d564d76
SHA512

95d3a3e1b5796816462e91cfb2914287862f827b41f8c3ab3b78cca75d8f9893371e15de5bdda3b8ce3ec6436734720989d136c53d3e542fba71ca88ee4e4ba3

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
lasco4000@

Targets

- Target
  
  IS099853EDCOO.com
- Size
  
  951KB
- MD5
  
  4c8cc9b59cce6e95f78f11b135748bd8
- SHA1
  
  cdca3d36f7424f97029425a89f5921afe6c3dcb7
- SHA256
  
  33719edd73278cc289278960c045181c39d5c0c1b3b101a2009946473d564d76
- SHA512
  
  95d3a3e1b5796816462e91cfb2914287862f827b41f8c3ab3b78cca75d8f9893371e15de5bdda3b8ce3ec6436734720989d136c53d3e542fba71ca88ee4e4ba3
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Drops file in Drivers directory

UPX packed file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2