agenttesla

General

Target

PAYMENTTRF889020022.exe
Size

355KB
Sample

221011-q5tkeagea4
MD5

1d00728cbb02b69a8cad3f032be410c8
SHA1

a803d959e77cdbec645288fe922d12e6888a209a
SHA256

c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff
SHA512

8858475d2f17f2f6786cbcd33f64bcb1515c931fd095d7d1828b1765dca3d47e454ef961c3ce4e41c9087494530694ede7475c8f31d4d549a9b2d913cc5d7257
SSDEEP

6144:HNeZmLE2rXehVTdEMLjtEkzKJg5/mnc52iOu0anAU5hvrBAVGFryDgvMar819nYk:HNl9KhVTtLjmkzufc5D0aBvrXVkgzr85

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.collinssaludnatural.com
Port:
21
Username:
[email protected]
Password:
1Hhzqx^s+8Oe

Extracted

Family

nanocore

Version

1.2.2.0

C2

37.0.14.210:6060

127.0.0.1:6060

Mutex

9fc6520a-b866-467e-b702-7533f9b56460

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-04-25T14:53:00.256026436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6060
default_group
SWIFT
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9fc6520a-b866-467e-b702-7533f9b56460
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
37.0.14.210
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.collinssaludnatural.com/
Port:
21
Username:
[email protected]
Password:
1Hhzqx^s+8Oe

Targets

- Target
  
  PAYMENTTRF889020022.exe
- Size
  
  355KB
- MD5
  
  1d00728cbb02b69a8cad3f032be410c8
- SHA1
  
  a803d959e77cdbec645288fe922d12e6888a209a
- SHA256
  
  c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff
- SHA512
  
  8858475d2f17f2f6786cbcd33f64bcb1515c931fd095d7d1828b1765dca3d47e454ef961c3ce4e41c9087494530694ede7475c8f31d4d549a9b2d913cc5d7257
- SSDEEP
  
  6144:HNeZmLE2rXehVTdEMLjtEkzKJg5/mnc52iOu0anAU5hvrBAVGFryDgvMar819nYk:HNl9KhVTtLjmkzufc5D0aBvrXVkgzr85
Score

10^/10

agenttesla nanocore collection evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

NanoCore

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2