agenttesla

General

Target
REVISED PROFORMA INVOICE.exe
Size 402KB
Sample201109-k2h4pvdft2
SHA256 4d1fc12e362e8f90ad1407c54575e3c39f3fd8cacde48007ecf46baa9ba1473d
MD5 5cc2088692390c0ec769de5f619e391d
SHA1 3339db49a7562eca0d85d221159742261e3df652
SHA512 367b58a2d1f5378f0c5909e5a3c092e265e3f56cae8b17b7542ff7c6556e093df1335b8a3d48fbd04f81135d2cd3cf42ca2bf59b2ce82c5863a65e5c8edac1ea
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  REVISED PROFORMA INVOICE.exe
- Size 402KB
- SHA256 4d1fc12e362e8f90ad1407c54575e3c39f3fd8cacde48007ecf46baa9ba1473d
- MD5 5cc2088692390c0ec769de5f619e391d
- SHA1 3339db49a7562eca0d85d221159742261e3df652
- SHA512 367b58a2d1f5378f0c5909e5a3c092e265e3f56cae8b17b7542ff7c6556e093df1335b8a3d48fbd04f81135d2cd3cf42ca2bf59b2ce82c5863a65e5c8edac1ea
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2