agenttesla | af5e42f54bbd7bf148b0f6fc1ac27b24c35f8012c3ef7e325de95a8c03bb6200 | Triage

Sharing

General

Target

af5e42f54bbd7bf148b0f6fc1ac27b24c35f8012c3ef7e325de95a8c03bb6200
Size

680KB
Sample

240328-bjzrzaab34
MD5

4b3f6221ed34fb691f8ae67ac12f130e
SHA1

73617fbb7b533ffb4ad12010c6e06192254b53f5
SHA256

af5e42f54bbd7bf148b0f6fc1ac27b24c35f8012c3ef7e325de95a8c03bb6200
SHA512

f308573abba922e3123f18128f891fb69a1e51ad98d3da6346f71a776dd61362f1f340ffecf1c06a5895ca0f37d7a5e9193fc82c59e74c2f4ec4e6bf4befe5ce
SSDEEP

12288:g4gD4NS8vlf8iezp5fXixBPKjD7ScFPD8aoVZ+5cxdL83lQ/iCPBuM+J:uD4S8vlf8NzXivyrZQaozPbi8I

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7131275962:AAE-dJRIntufGLICZWLXrTBpxMw_24XDbCc/

Targets

- Target
  
  af5e42f54bbd7bf148b0f6fc1ac27b24c35f8012c3ef7e325de95a8c03bb6200
- Size
  
  680KB
- MD5
  
  4b3f6221ed34fb691f8ae67ac12f130e
- SHA1
  
  73617fbb7b533ffb4ad12010c6e06192254b53f5
- SHA256
  
  af5e42f54bbd7bf148b0f6fc1ac27b24c35f8012c3ef7e325de95a8c03bb6200
- SHA512
  
  f308573abba922e3123f18128f891fb69a1e51ad98d3da6346f71a776dd61362f1f340ffecf1c06a5895ca0f37d7a5e9193fc82c59e74c2f4ec4e6bf4befe5ce
- SSDEEP
  
  12288:g4gD4NS8vlf8iezp5fXixBPKjD7ScFPD8aoVZ+5cxdL83lQ/iCPBuM+J:uD4S8vlf8NzXivyrZQaozPbi8I
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslaevasionkeyloggerspywarestealertrojan

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan