agenttesla

General

Target

db769d7bd183986649c1deb6c82517a37ed2dddd53217bbf52a1480276519fa3
Size

478KB
Sample

220521-cf12asghbk
MD5

e26d05576224f793d510b7245e481d6d
SHA1

5edacbcaebe8d6f2f3ed866298e28536364042db
SHA256

db769d7bd183986649c1deb6c82517a37ed2dddd53217bbf52a1480276519fa3
SHA512

929d76b7564217c7fc8a97cb698d267f1d3f0c32b26af0b992c4b2fdc60b7f459dfae6bf50a7d46b67206e035937b42bc55f1e56979f5962d1b66893ed53e420

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pptoursperu.com
Port:
587
Username:
[email protected]
Password:
mailppt2019-

Targets

- Target
  
  NEW PURCHASE ORDER.exe
- Size
  
  502KB
- MD5
  
  c8aa43fa29e981c8e0a1a307c703a948
- SHA1
  
  31a6ac6ad48d14f6719086f343d5c74a1657dd0f
- SHA256
  
  661a23fbb68a04d534e7dc2f481065984141666fac72ef0a5342a622c0a1fba3
- SHA512
  
  b89c07b893cdd86ba697b00740d769b7d46c4e19ea9046919f953c45bcd66969de3807c481a4a1036b943f0a41015eead66b3333d8ef6710355a3dfef3bb0056
Score

10^/10

agenttesla collection evasion keylogger persistence rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

ReZer0 packer

Disables Task Manager via registry modification

Drops file in Drivers directory

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2