agenttesla | 2255e8a54808ce7bf44bc4c8128a9b516b3e7bbd2bf041bcab8d7f5561178267 | Triage

Sharing

General

Target

IlXopUgIznv0S8TIEoqbUWs_e70r8EG8q41-VWEXgmc.bin
Size

455KB
Sample

221124-xnvjpsgb2t
MD5

d8d8608925b1c2d82cbc4fa527e05abe
SHA1

24c59446cf97af6c413c00a2fa74de710bd90260
SHA256

2255e8a54808ce7bf44bc4c8128a9b516b3e7bbd2bf041bcab8d7f5561178267
SHA512

4047bdf3e8297d1cfe8c36bb2fe32b3b388dc26ad94a5524e97e58b04477bbd716d07187a75300585f323c09244d7e506ed7cf72787615d6f8434f0c0be5a1f4
SSDEEP

12288:yCIKJphjJFDP1P0i2CQF82LdqQsKsTklnlBefw:ljJtTXqJx2u

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
carnotae.tk
Port:
587
Username:
delivery@carnotae.tk
Password:
shankiki1A@

Targets

- Target
  
  IlXopUgIznv0S8TIEoqbUWs_e70r8EG8q41-VWEXgmc.bin
- Size
  
  455KB
- MD5
  
  d8d8608925b1c2d82cbc4fa527e05abe
- SHA1
  
  24c59446cf97af6c413c00a2fa74de710bd90260
- SHA256
  
  2255e8a54808ce7bf44bc4c8128a9b516b3e7bbd2bf041bcab8d7f5561178267
- SHA512
  
  4047bdf3e8297d1cfe8c36bb2fe32b3b388dc26ad94a5524e97e58b04477bbd716d07187a75300585f323c09244d7e506ed7cf72787615d6f8434f0c0be5a1f4
- SSDEEP
  
  12288:yCIKJphjJFDP1P0i2CQF82LdqQsKsTklnlBefw:ljJtTXqJx2u
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan