agenttesla

General

Target

3c538ae59b80d697d9303c8a9a4a13fc5d5320857875f904795d01562e5f3a2a.zip
Size

598KB
Sample

240327-cndkzaac22
MD5

89880f36b9129a8e39c543c1dbc80526
SHA1

892b8c2809a64c7cccf99caa7ddb522a0d7feabc
SHA256

3c538ae59b80d697d9303c8a9a4a13fc5d5320857875f904795d01562e5f3a2a
SHA512

75665a803a0a125f300114e82f2f15c954a5b1964c675f0f0933eedafe7299825442bf347c90d8516e16c40663147d0175090c5e050b7b90a8afec8b5a53fd0f
SSDEEP

12288:zzI+JfNkkyRaGxscEUMstFF0H45Aiyu9t2crxXAv0uIAKaf:zc+NNRuxNNYiv1FXAMj2

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.starlinetrading.com
Port:
587
Username:
[email protected]
Password:
Tmn@#1571963?%
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.starlinetrading.com
Port:
587
Username:
[email protected]
Password:
Tmn@#1571963?%

Targets

- Target
  
  SHIPPING DOCUMENTS.exe
- Size
  
  615KB
- MD5
  
  86dfaa3196ac1180b5bd54c6addf7ca5
- SHA1
  
  f302cf1dd35df3ca9fa8b813118c4aa313b37087
- SHA256
  
  ac517064216de46a3c1ab91e2623170b89eef04b4e64b1c24149c1bb64b24ec8
- SHA512
  
  a20413165f74faa85f7f0b6eb57c60279cf2850925821608a63e7aec5b27de5a8f1aebe3268415ff8c2054a0f82f38938cefbae421137e6082ecb3898330662b
- SSDEEP
  
  12288:8Qla5Wssg0ReoxacuUM2tFVGHmrWiSu9tMA390ozn3OqZ1iSN4dw4tjZw6sMA4Ta:7/UCxb16iPNtRbOqZwSN4dw4tjZw6sM6
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with SmartAssembly
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables packed with SmartAssembly

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2