agenttesla | 8c5c6b99a06119e1064bfcf3f53cc66150751c0969dc37dc3603eef5535a8af9 | Triage

Sharing

General

Target

e-dekont_html.exe
Size

610KB
Sample

240325-tzpaaaff71
MD5

66e196c15ec46d1e7526b1c48da1b72a
SHA1

f9b2dc950a21c296aaf57a013c3f4e93f8ebbad2
SHA256

8c5c6b99a06119e1064bfcf3f53cc66150751c0969dc37dc3603eef5535a8af9
SHA512

f8d8241d5af76033ba83caff888d325285110356b8e35175260a912cf416670465d218d7c550b9f15cc969bc2f53381cb8e41dd4f9a859cae65e4df600b6f851
SSDEEP

12288:yRfHhxVzsP5wzyNwv5gs3MjeNPq0wKrCHrT3GQzRVPUYvV3L2dXEg:yXxU5wzaktc4PEWCHfGQzbPfvFydXEg

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  e-dekont_html.exe
- Size
  
  610KB
- MD5
  
  66e196c15ec46d1e7526b1c48da1b72a
- SHA1
  
  f9b2dc950a21c296aaf57a013c3f4e93f8ebbad2
- SHA256
  
  8c5c6b99a06119e1064bfcf3f53cc66150751c0969dc37dc3603eef5535a8af9
- SHA512
  
  f8d8241d5af76033ba83caff888d325285110356b8e35175260a912cf416670465d218d7c550b9f15cc969bc2f53381cb8e41dd4f9a859cae65e4df600b6f851
- SSDEEP
  
  12288:yRfHhxVzsP5wzyNwv5gs3MjeNPq0wKrCHrT3GQzRVPUYvV3L2dXEg:yXxU5wzaktc4PEWCHfGQzbPfvFydXEg
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaevasionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan