agenttesla | 0f646539e424b78145f10890170c52f952ef950c3530b3b36979ea805d1c3b22 | Triage

Sharing

General

Target

DHL EXPRESS.exe
Size

1.1MB
Sample

240424-kkmngagb6y
MD5

7bc30d8e9682aa4832cc11276c802d43
SHA1

344101f20049c6c9ebc082a8db3d398006a1a8bb
SHA256

0f646539e424b78145f10890170c52f952ef950c3530b3b36979ea805d1c3b22
SHA512

0d3afa12c8050ed2da39d34b549ff4cfd4a750e638796bedafd0c824c53f7b33e4faa97c3f053a0e1de9670edf2a2aa61106e2e55244f133421f51bae9b166a7
SSDEEP

24576:Q0QxU0g8+jwId+JTqovW4Ts3vCNaLe3gRuzh:Qg8GL4TRvW+0a8L4g0zh

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6701733689:AAGMmNWA2G1J2dS7tNzTXuPC1zohWE8wZcU/

Targets

- Target
  
  DHL EXPRESS.exe
- Size
  
  1.1MB
- MD5
  
  7bc30d8e9682aa4832cc11276c802d43
- SHA1
  
  344101f20049c6c9ebc082a8db3d398006a1a8bb
- SHA256
  
  0f646539e424b78145f10890170c52f952ef950c3530b3b36979ea805d1c3b22
- SHA512
  
  0d3afa12c8050ed2da39d34b549ff4cfd4a750e638796bedafd0c824c53f7b33e4faa97c3f053a0e1de9670edf2a2aa61106e2e55244f133421f51bae9b166a7
- SSDEEP
  
  24576:Q0QxU0g8+jwId+JTqovW4Ts3vCNaLe3gRuzh:Qg8GL4TRvW+0a8L4g0zh
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan