agenttesla

General

Target
RFQ11132022-SOEC.exe
Size 509KB
Sample221115-dtln7sbb2v
SHA256 fcaf490e6ee9254f89eecbce2dd1dfa355e450c30a8648e7db43db4c5e9e434d
MD5 3658c7ca2a9b3772906f1b5302cb9d6a
SHA1 927325caa14d2c8c02f66ac9379c437b2b2f8b39
SHA512 18ebbe3dec6d7c4b5ce0577b49f99ed5fd77edb163d485773644998c859e73f24398c4950cdb32b0d570bd4426b287fa4df161a22296b836e8283b6a7f16596b
SSDEEP 12288:pBatuwVeMsI+7otGSHxOY4P04gk/SYEyPjNC:pBat3+mHxYMEqYE2o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.electrobist.com
Port
21
Username
[email protected]
Password
w&oNc9e]pf~4

Targets

- Target
  RFQ11132022-SOEC.exe
- Size 509KB
- SHA256 fcaf490e6ee9254f89eecbce2dd1dfa355e450c30a8648e7db43db4c5e9e434d
- MD5 3658c7ca2a9b3772906f1b5302cb9d6a
- SHA1 927325caa14d2c8c02f66ac9379c437b2b2f8b39
- SHA512 18ebbe3dec6d7c4b5ce0577b49f99ed5fd77edb163d485773644998c859e73f24398c4950cdb32b0d570bd4426b287fa4df161a22296b836e8283b6a7f16596b
- SSDEEP 12288:pBatuwVeMsI+7otGSHxOY4P04gk/SYEyPjNC:pBat3+mHxYMEqYE2o
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2