agenttesla

General

Target

3b851cdb7318d975f510336e3fa77b0c367c45c57173d4f3406c9d1bc369096b
Size

2.0MB
Sample

220521-xcyf8aegcp
MD5

a06fc8cf22ec4fe7c1b51443bddba18f
SHA1

476ce5fcb018b5df571832093f186c8e87f3fc4f
SHA256

3b851cdb7318d975f510336e3fa77b0c367c45c57173d4f3406c9d1bc369096b
SHA512

a21fbdb0da78ccdba33141b2cc989df98709d70745aabb8918b4f7e0db3f4f87faf841dbe2f761a70a3c6e9055b99913a91c4e66f5f41cd8eb7812ec1b8a529a

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.parshavayealborz.com
Port:
587
Username:
info@parshavayealborz.com
Password:
P@rshava123456

Targets

- Target
  
  SOA.rar.exe
- Size
  
  2.0MB
- MD5
  
  6e87a2e7ef62721a2aef357431076a7a
- SHA1
  
  1cdf35c6ea661a2ef0461d7b8de441eb8dd802b1
- SHA256
  
  5f409bddf5b4efe31ec833332774381385c1a31e3e2d8e5e3b2d2f934be0a5a7
- SHA512
  
  a752bb0fb663a27d4034478f3b4b63e005ce5b95a3db699b7918a59583e25182b50eca769994008bf6fc00ad9819daa91f476384c12e5511f8716da668f221dc
Score

10^/10

agenttesla collection evasion keylogger persistence rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

ReZer0 packer

Disables Task Manager via registry modification

Drops file in Drivers directory

Drops startup file

Accesses Microsoft Outlook profiles

Adds Run key to start application

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2