agenttesla

General

Target
PAYMENT FILE.exe
Size 575KB
Sample201020-lfwf13l6qa
SHA256 11aa674f8afded009bf253c53c4e65b69bf31eb946f2d9b82b7d2ce79a175e14
MD5 001085bb4ea16285bb454d9f49e33470
SHA1 5e11e4ac07ce18325cd40bf0e6795e6ae5557614
SHA512 a95b75c7f0f82ed9ce12a0ee42c6de16a840f06b9794b3ad123dbbdfb38c7475d6e4029ae52c07c3c35ae088a8f13ecf24266832a8feaeb2747ec2fcd9a4046f
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.kamazfs.biz
Port
587
Username
[email protected]
Password
f*wqZyd1

Targets

- Target
  PAYMENT FILE.exe
- Size 575KB
- SHA256 11aa674f8afded009bf253c53c4e65b69bf31eb946f2d9b82b7d2ce79a175e14
- MD5 001085bb4ea16285bb454d9f49e33470
- SHA1 5e11e4ac07ce18325cd40bf0e6795e6ae5557614
- SHA512 a95b75c7f0f82ed9ce12a0ee42c6de16a840f06b9794b3ad123dbbdfb38c7475d6e4029ae52c07c3c35ae088a8f13ecf24266832a8feaeb2747ec2fcd9a4046f
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2