agenttesla

General

Target

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Size

274KB
Sample

211020-aa38csgdg8
MD5

78d10b686503f8b21b0fa517e17fa39e
SHA1

3b2f329b207365d4d1eb69a75bb9a43ae5bf3c12
SHA256

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046
SHA512

d3924caee3cb5e962703f019edd2c14dfc82360e882c67af38181bbdabadd53843cc41507f13eee64d9ddcff729f466531efcfa80f39922fc8c731a4b6a10737

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://iykl.xyz/Spartan3/w2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.suissajoiers.com
Port:
587
Username:
[email protected]
Password:
suissajoiers.

Targets

- Target
  
  0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
- Size
  
  274KB
- MD5
  
  78d10b686503f8b21b0fa517e17fa39e
- SHA1
  
  3b2f329b207365d4d1eb69a75bb9a43ae5bf3c12
- SHA256
  
  0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046
- SHA512
  
  d3924caee3cb5e962703f019edd2c14dfc82360e882c67af38181bbdabadd53843cc41507f13eee64d9ddcff729f466531efcfa80f39922fc8c731a4b6a10737
Score

10^/10

lokibot collection spyware stealer trojan agenttesla keylogger
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- AgentTesla Payload
- Downloads MZ/PE file
- Executes dropped EXE
- Drops startup file
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Lokibot

AgentTesla Payload

Downloads MZ/PE file

Executes dropped EXE

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2