agenttesla

General

Target
3aff71a139f4a5201d81b00a4a1d17c4.exe
Size 570KB
Sample201016-lsk3qbfetj
SHA256 d9029ab42ac205dc948b7d7d03010db9bc5c9a1893bd72bb0970a82751e2f047
MD5 3aff71a139f4a5201d81b00a4a1d17c4
SHA1 4c7bb89744edcb140ccf219f66caae4f79a16e8f
SHA512 0cf1a54cf7e0ae519581ce903fa1722e2b9269669f0d37b5de9a216778dd5872639617e96343d995e6c874ba174fcad3c84cf311bfc198d8758fd49201b30374
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.kamazfs.biz
Port
587
Username
[email protected]
Password
f*wqZyd1

Targets

- Target
  3aff71a139f4a5201d81b00a4a1d17c4.exe
- Size 570KB
- SHA256 d9029ab42ac205dc948b7d7d03010db9bc5c9a1893bd72bb0970a82751e2f047
- MD5 3aff71a139f4a5201d81b00a4a1d17c4
- SHA1 4c7bb89744edcb140ccf219f66caae4f79a16e8f
- SHA512 0cf1a54cf7e0ae519581ce903fa1722e2b9269669f0d37b5de9a216778dd5872639617e96343d995e6c874ba174fcad3c84cf311bfc198d8758fd49201b30374
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2