agenttesla | 013288d86412f1ab6839deb1562ec98ba6dad27e0e847a1a7b5526a7737a62d7 | Triage

Sharing

General

Target

013288d86412f1ab6839deb1562ec98ba6dad27e0e847a1a7b5526a7737a62d7
Size

620KB
Sample

240328-bj1n9scd8t
MD5

6aff7fae411e1e1f8619f554512d6c91
SHA1

66970f2a85c3c2fbf27b8fd85ffa6089eceaeabc
SHA256

013288d86412f1ab6839deb1562ec98ba6dad27e0e847a1a7b5526a7737a62d7
SHA512

aebbec988c1f18701707b693a7bc88aac612c1610edb8809e65737297c487572986523edd2cde5dc6524f4c7476da06bbb6350dccfd881c4df8b6790d97231be
SSDEEP

12288:3YFP0VEOR1PSrJJ1KkEGzcQVfukwgjPaxi10YtFnnL7Wu/NkDqD:3WO3SrJJ1pXVfuOiKJW0P

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7131275962:AAE-dJRIntufGLICZWLXrTBpxMw_24XDbCc/

Targets

- Target
  
  013288d86412f1ab6839deb1562ec98ba6dad27e0e847a1a7b5526a7737a62d7
- Size
  
  620KB
- MD5
  
  6aff7fae411e1e1f8619f554512d6c91
- SHA1
  
  66970f2a85c3c2fbf27b8fd85ffa6089eceaeabc
- SHA256
  
  013288d86412f1ab6839deb1562ec98ba6dad27e0e847a1a7b5526a7737a62d7
- SHA512
  
  aebbec988c1f18701707b693a7bc88aac612c1610edb8809e65737297c487572986523edd2cde5dc6524f4c7476da06bbb6350dccfd881c4df8b6790d97231be
- SSDEEP
  
  12288:3YFP0VEOR1PSrJJ1KkEGzcQVfukwgjPaxi10YtFnnL7Wu/NkDqD:3WO3SrJJ1pXVfuOiKJW0P
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslaevasionkeyloggerspywarestealertrojan

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan