agenttesla | 751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6 | Triage

Sharing

General

Target

751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6
Size

618KB
Sample

240125-vyvakscdhp
MD5

89a59e73c237d1481548d88515394670
SHA1

f15a5ec1eede4b6775a63437b1b6680e22114ea1
SHA256

751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6
SHA512

4f42b8f1def1b1933422228f26ca7a956f081a432ac1f506ef1a117386851ff1526e6e01e3b998ada010cff0445d9c4fde9324a750f9f271712d7fff5c849543
SSDEEP

12288:7mJgA6dpf4hbwI1ZuIWaa4Dw7OcZtiyQmeeDDRjBCK6iWpWUv2fL:CaLdShv1wIWaaJVvivm/BChiWpWE2

Score

10^/10

agenttesla kinsing keylogger loader persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bilimseltipyayinevi.com
Port:
587
Username:
[email protected]
Password:
G2_PYKYRz9rNWye
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.bilimseltipyayinevi.com
Port:
587
Username:
[email protected]
Password:
G2_PYKYRz9rNWye

Targets

- Target
  
  751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6
- Size
  
  618KB
- MD5
  
  89a59e73c237d1481548d88515394670
- SHA1
  
  f15a5ec1eede4b6775a63437b1b6680e22114ea1
- SHA256
  
  751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6
- SHA512
  
  4f42b8f1def1b1933422228f26ca7a956f081a432ac1f506ef1a117386851ff1526e6e01e3b998ada010cff0445d9c4fde9324a750f9f271712d7fff5c849543
- SSDEEP
  
  12288:7mJgA6dpf4hbwI1ZuIWaa4Dw7OcZtiyQmeeDDRjBCK6iWpWUv2fL:CaLdShv1wIWaaJVvivm/BChiWpWE2
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan kinsing loader
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakinsingkeyloggerloaderpersistencespywarestealertrojan