agenttesla

General

Target

b3a27137bfa9f92fe6b4cc7f0aaf08f4
Size

610KB
Sample

220208-kz2qyafbb8
MD5

b3a27137bfa9f92fe6b4cc7f0aaf08f4
SHA1

266e5d674bd1fe6135bd74658bb8a1d58777bbe0
SHA256

37c712662321d51383b50cc3973ba187706384859c6ff4f9e43e8be3c9e6dfe4
SHA512

2aec6a1ffd6a1df55ca456ed80b42b28f10f98ab11ab1cfefad29529037e433a7cb527ab081fbcddcf38c70adf2b0bbb484e936f42a5720fbfc2943b7d96a37a

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://nanyainc.cf/
Port:
21
Username:
[email protected]
Password:
7qB+iH=KrUUT

Targets

- Target
  
  b3a27137bfa9f92fe6b4cc7f0aaf08f4
- Size
  
  610KB
- MD5
  
  b3a27137bfa9f92fe6b4cc7f0aaf08f4
- SHA1
  
  266e5d674bd1fe6135bd74658bb8a1d58777bbe0
- SHA256
  
  37c712662321d51383b50cc3973ba187706384859c6ff4f9e43e8be3c9e6dfe4
- SHA512
  
  2aec6a1ffd6a1df55ca456ed80b42b28f10f98ab11ab1cfefad29529037e433a7cb527ab081fbcddcf38c70adf2b0bbb484e936f42a5720fbfc2943b7d96a37a
Score

10^/10

agenttesla neshta keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- AgentTesla Payload
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies system executable filetype association

Neshta

AgentTesla Payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2