agenttesla | 2c2d5c6ad55ef859bfbd52c17ef210c1364509982c117d988b0909297cf379db | Triage

Sharing

General

Target

Especificaciones de.tgz.gz
Size

391KB
Sample

221123-ltcejacc45
MD5

1bab7fef88993de66a905f0d82a9f3c5
SHA1

eae919b8a8c9853c62f10c90e555c714fc2fd369
SHA256

2c2d5c6ad55ef859bfbd52c17ef210c1364509982c117d988b0909297cf379db
SHA512

aa207be1c1f4d70ac834ef8953126f6ff9811c099ae3e8d59f5be62f6527f9dc753ba6f825f1d1849e79d81feff8405092b5075788da99a2de10be3ad68ea203
SSDEEP

1536:V4vAQK0VcQBP/T1qWZmK1W4wD/bGKIihEtT7pBIGas6hrR8WqP9Yu:V4vfK0WQBpq8mKBwD/h3hYpiXH8WUYu

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/

Targets

- Target
  
  Especificaciones de.exe
- Size
  
  300.1MB
- MD5
  
  05886c33e418fd16ae58f7862b097c7a
- SHA1
  
  7078abd95bbc058c6c82554e1af6f745a68f9e45
- SHA256
  
  7abdf3084191f971d02ad13d7e5addd487ac3ca310e89f06d1412fd85cb2570f
- SHA512
  
  b42ddf0caff445aeac88919f85bd63acaff6a6d3c2bdc2a98646772547046e79a381f60f9266f2610c2da2ef884b2f3e6759482f05a631a17aab26dd10a5a17e
- SSDEEP
  
  3072:jvwPtt+FyM1uOWPR6S8TFwsaipiXH8f3x:jtXlWPRkhwsaipiXAh
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslakeyloggerspywarestealertrojan