agenttesla | 70617956711aee0ab22b1ef97b95351d4462360f5709d7a265c4edc7ad4ab870 | Triage

Sharing

General

Target

FATURA PROFORMA.gz
Size

611KB
Sample

240424-rzy4dabg4x
MD5

065248ab0202957ec83b8f7f2144a01a
SHA1

7bdd63b048d2ab21322a7aec2fff5d03f0b0b2b8
SHA256

70617956711aee0ab22b1ef97b95351d4462360f5709d7a265c4edc7ad4ab870
SHA512

9d6ba31ca7369c07a791d671feed405ac0841cea5b3c6532436ccc43fadfdee2a9dad7a0b89482505172d649117e75dba1b8564434f085060313e6552b983477
SSDEEP

12288:K74kDDfNeZmaKnqtaF5KpOKDjPvzoGQbQvZLD:KFPf6maAqtaF5KpOKDjP4o5D

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pmknycc.in
Port:
587
Username:
[email protected]
Password:
Host@@2020
Email To:
[email protected]

Targets

- Target
  
  FATURA PROFORMA.exe
- Size
  
  733KB
- MD5
  
  23e189bd0552c1601a8e0f9ba8d15c86
- SHA1
  
  4094f42d511ab76f00f62dad7d40d42015e87651
- SHA256
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6
- SHA512
  
  f83e3386b8175359b4b8a6fb9d8e692b1ea427215005064766198fa9667c276117eedff8977a76977604043370d44aa4514605946ae8eb22ec1ef339018c1100
- SSDEEP
  
  12288:bdFkDzZLeZIasnetaFPWpOiDF/5zGSQVQ/Z9l:bdu/ZoIa6etaFPWpOiDF/Oy3l
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan