agenttesla | c96565623c3e405a370614f452383a763f5a48baf25e79f91a6311c9a0a8fd3a | Triage

Sharing

General

Target

Total Invoices.exe
Size

789KB
Sample

240424-bmsstsde68
MD5

cd3c05ebb9a3fca7aa748f522559b1ea
SHA1

43dc8cdf47186a54dc38cd86450aca6f6361a9b4
SHA256

c96565623c3e405a370614f452383a763f5a48baf25e79f91a6311c9a0a8fd3a
SHA512

5d11d8dbec417ed7c8bd9f2b49925c01440b4d517cff1190d411e832528550f0e6645c7005dbd0953aafb82ba7d25977351f0ad5aba5736bd62140a3d0cc2e6a
SSDEEP

24576:7ldr5ja9fm5r+jrZf1vsAJ2jN5GFhXuv:7lbjH5srZtvXouj

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.unitechautomations.com
Port:
587
Username:
[email protected]
Password:
Unitech@123
Email To:
[email protected]

Targets

- Target
  
  Total Invoices.exe
- Size
  
  789KB
- MD5
  
  cd3c05ebb9a3fca7aa748f522559b1ea
- SHA1
  
  43dc8cdf47186a54dc38cd86450aca6f6361a9b4
- SHA256
  
  c96565623c3e405a370614f452383a763f5a48baf25e79f91a6311c9a0a8fd3a
- SHA512
  
  5d11d8dbec417ed7c8bd9f2b49925c01440b4d517cff1190d411e832528550f0e6645c7005dbd0953aafb82ba7d25977351f0ad5aba5736bd62140a3d0cc2e6a
- SSDEEP
  
  24576:7ldr5ja9fm5r+jrZf1vsAJ2jN5GFhXuv:7lbjH5srZtvXouj
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan