agenttesla | 23cf8326185714963cd47f4e723978198af2d67ad29c7b0adfceb488681a27b0 | Triage

Sharing

General

Target

4cf86422d38e37c1e08c4b3b3128e6b9.bin
Size

606KB
Sample

240327-cpawgaac53
MD5

6be1452b8bec393d229fffcf2dde66da
SHA1

62160c6bf80956b1f58e9342ec02af865ed13085
SHA256

23cf8326185714963cd47f4e723978198af2d67ad29c7b0adfceb488681a27b0
SHA512

c508e3fc357dbe126a08904a55720eba7e98cea2a9e0dee7a593189aa0ef1379ec9bd4273bb1d276fc9b802ff95191933298f0fbaa41f7b5aa950c940a023df8
SSDEEP

12288:v+5thBfZ41OdA23qoeIf9fgSpl2ndadN15cAZcjfGvLE/HIz/LK8D1Jq2:v+5ZZNdVQIBidar1HZcjXvl8D/3

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  4914d971c34eb5a8af4e83e4d0a9edd358d12b54e87a949420e5e82897452d40.exe
- Size
  
  956KB
- MD5
  
  4cf86422d38e37c1e08c4b3b3128e6b9
- SHA1
  
  88a3cd955c9ffc6b6a20da4e3133ba019faa5985
- SHA256
  
  4914d971c34eb5a8af4e83e4d0a9edd358d12b54e87a949420e5e82897452d40
- SHA512
  
  d654f3471cafd8f848345a2e1b69db3f5505164b095dc3b2816cebd68198201858ceb2df75a35c1131f58625a0c2230231098c17d7c3a944d9f259271659d762
- SSDEEP
  
  12288:R7oRh0OKD4TkZjaEp87Tb5tcxJEpuVbeqoXGEaBbdy3ENd1I5PnNryPHpkB0zZFS:xD4TkZjkX4J0IdgayjfZyvpkB9
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaevasionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan