agenttesla | 9c4fc8863b69831ba6b261d813788cd49677c2f02fe9c82ad8426141cd326ef4 | Triage

Sharing

General

Target

9c4fc8863b69831ba6b261d813788cd49677c2f02fe9c82ad8426141cd326ef4
Size

613KB
Sample

240330-bk1qnaed78
MD5

b32eb4a8fe11ff1285c91012101a6b1c
SHA1

323ef8a89c0818681b876e9dd38a766a7ff7ea9c
SHA256

9c4fc8863b69831ba6b261d813788cd49677c2f02fe9c82ad8426141cd326ef4
SHA512

58f4c116b178e438682bb4c70ec780863b8fdac10327c472160b7bb14c864448070862728a8b9f53fc827c018e418937d7999f6267b9b7cb2e69f20e0629dc15
SSDEEP

12288:YpqoRGAfwtAerE0Sz+lT6jkdznt7sKNVFyinAfQdpTQlefYdtm68ZqV4:4RGcwGMmz+dpzn1E7fQd1IefYqqV4

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  9c4fc8863b69831ba6b261d813788cd49677c2f02fe9c82ad8426141cd326ef4
- Size
  
  613KB
- MD5
  
  b32eb4a8fe11ff1285c91012101a6b1c
- SHA1
  
  323ef8a89c0818681b876e9dd38a766a7ff7ea9c
- SHA256
  
  9c4fc8863b69831ba6b261d813788cd49677c2f02fe9c82ad8426141cd326ef4
- SHA512
  
  58f4c116b178e438682bb4c70ec780863b8fdac10327c472160b7bb14c864448070862728a8b9f53fc827c018e418937d7999f6267b9b7cb2e69f20e0629dc15
- SSDEEP
  
  12288:YpqoRGAfwtAerE0Sz+lT6jkdznt7sKNVFyinAfQdpTQlefYdtm68ZqV4:4RGcwGMmz+dpzn1E7fQd1IefYqqV4
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaevasionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan