agenttesla | f2827994224ee4c40151c42c38044dadb2e6111966028afd127fefa8636edb79 | Triage

Sharing

General

Target

NEAS.f2827994224ee4c40151c42c38044dadb2e6111966028afd127fefa8636edb79.exe
Size

406KB
Sample

231202-mecx7aca44
MD5

da3e7fb79e5432ba9a9ec8dcb7e06cde
SHA1

3f156007d8bce03b4ce8aab2ce955bb7367027ba
SHA256

f2827994224ee4c40151c42c38044dadb2e6111966028afd127fefa8636edb79
SHA512

cac7cbbb737342b53daca5d1c9c9192ea2c9e88e39ae49b7b7a3c77fcd538e92264c834b8698a4a245f1dc95dc8b5a4f6c0a4abc3f20959b6b4abc249bbbdfd5
SSDEEP

12288:wy4uGuYFIhy2jT842ridRj0wDU+GXXLhE:wy4uGumIE2jw42iNJH+XC

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  NEAS.f2827994224ee4c40151c42c38044dadb2e6111966028afd127fefa8636edb79.exe
- Size
  
  406KB
- MD5
  
  da3e7fb79e5432ba9a9ec8dcb7e06cde
- SHA1
  
  3f156007d8bce03b4ce8aab2ce955bb7367027ba
- SHA256
  
  f2827994224ee4c40151c42c38044dadb2e6111966028afd127fefa8636edb79
- SHA512
  
  cac7cbbb737342b53daca5d1c9c9192ea2c9e88e39ae49b7b7a3c77fcd538e92264c834b8698a4a245f1dc95dc8b5a4f6c0a4abc3f20959b6b4abc249bbbdfd5
- SSDEEP
  
  12288:wy4uGuYFIhy2jT842ridRj0wDU+GXXLhE:wy4uGumIE2jw42iNJH+XC
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan