agenttesla

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.7612.7858
Size 75KB
Sample220719-d37m2ahhak
SHA256 ae1f1bf92f637348e6c6dfe6b0f79ff8f542ceec0cc0acc45e99d2ac27177422
MD5 5dbdc552d104d7d691615c1b1f058c8d
SHA1 8ada815d9acde1eb1e45b9a1b35cd554c18c8fba
SHA512 2681ba79b12e49d024fa0cbcc55339c580758826f231c962c1da3be760bf73d7513273435f3c2de957c3d25efc31392cee1b8c35655009d1df7dffcbab287a60
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.barqaab.com
Port
587
Username
[email protected]
Password
Great@999@

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:9128
127.0.0.1:9121
23.105.131.196:6606
23.105.131.196:7707
23.105.131.196:8808
23.105.131.196:9128
23.105.131.196:9121

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.barqaab.com
Port
587
Username
[email protected]
Password
Great@999@
Email to
[email protected]

Targets

- Target
  SecuriteInfo.com.W32.AIDetectNet.01.7612.7858
- Size 75KB
- SHA256 ae1f1bf92f637348e6c6dfe6b0f79ff8f542ceec0cc0acc45e99d2ac27177422
- MD5 5dbdc552d104d7d691615c1b1f058c8d
- SHA1 8ada815d9acde1eb1e45b9a1b35cd554c18c8fba
- SHA512 2681ba79b12e49d024fa0cbcc55339c580758826f231c962c1da3be760bf73d7513273435f3c2de957c3d25efc31392cee1b8c35655009d1df7dffcbab287a60
- MD5 SHA1 SHA512
Score

10^/10

agenttesla asyncrat default collection keylogger rat spyware stealer suricata trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata
- Async RAT payload
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

AsyncRat

suricata: ET MALWARE AgentTesla Exfil Via SMTP

Async RAT payload

Executes dropped EXE

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2