agenttesla | b0aace6843e2fe064c6b22f99851ada2764789d620c92e6faa74b47ded3dae5f | Triage

Sharing

General

Target

e034dcab67a1ef7eb1f65347439ed212.bin
Size

19KB
Sample

230605-p5hmgagf94
MD5

59655cb9564f7b8f41a431d51522479f
SHA1

5395ab9d74a70dfe1541b8bc05c9aee7b73984fb
SHA256

b0aace6843e2fe064c6b22f99851ada2764789d620c92e6faa74b47ded3dae5f
SHA512

b9401c7acc311d8822ad96c3989fb8c74a107669cbc756e80a0864875adfcbc3012a09a760ac0e2ce54c1cc375740122ddae293466164f4e0feb1c1ea02b4943
SSDEEP

384:kUYPgAVl+CosDDQ/VgbyIpTuO4pXoAEpiAcnh2H5cGjGz/qKp20X8UPXS:kZPgarb0/VqyIpr4toAEcA6hsfTi/XS

Score

10^/10

agenttesla purecrypter collection downloader keylogger loader persistence spyware stealer trojan

Malware Config

Extracted

Family

purecrypter

C2

http://208.67.107.146/Xvhwgnaxcaj.png

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6237173637:AAHL1SZ0swNAdHMB508Hs_WnK-RKakXlUmA/

Targets

- Target
  
  77b72d9e11b5b61983903918dfb822e8c6c1e3a4acd6a5fde5db7a3cf004b445.exe
- Size
  
  103KB
- MD5
  
  e034dcab67a1ef7eb1f65347439ed212
- SHA1
  
  d33baf287318eb7b0cf5725712203d35d3ac80d8
- SHA256
  
  77b72d9e11b5b61983903918dfb822e8c6c1e3a4acd6a5fde5db7a3cf004b445
- SHA512
  
  c94de9a264e876d1d00e1a51b3ea5590c66d0099a010259e3fda9c7cc82714139246fbbddc1ea1c714aec7f8b856e459e3718180c1522a82320f1950a6027953
- SSDEEP
  
  768:pp1PpUMVzUSRmST294dWa2P7b1IzPrXMkN336DXa:z1P+iwSD294dN2PmfMkN3KDq
Score

10^/10

agenttesla purecrypter collection downloader keylogger loader persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- PureCrypter
  PureCrypter is a .NET malware loader first seen in early 2021.
  loader downloader purecrypter
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslapurecryptercollectiondownloaderkeyloggerloaderpersistencespywarestealertrojan

behavioral2

agentteslapurecryptercollectiondownloaderkeyloggerloaderpersistencespywarestealertrojan