agenttesla | 14a7dbc524ff90ed059e716fffdc071cc97d770901f80bb11d4bee5aace67fde | Triage

Sharing

General

Target

14a7dbc524ff90ed059e716fffdc071cc97d770901f80bb11d4bee5aace67fde
Size

797KB
Sample

240425-b63gdadc4x
MD5

41a86b771c2ba734138fd135292e31e6
SHA1

34604125a46c0e22059cc6ec10b1d0f764a927b9
SHA256

14a7dbc524ff90ed059e716fffdc071cc97d770901f80bb11d4bee5aace67fde
SHA512

ff69b42311e17a00308b364c2923c35873c7e4a02edaf7414fea21596661c640fe8cc0ad94ee41677d0c304e0f1b05ca3df9ce844dc221855cfe69699fcef10d
SSDEEP

12288:IU2iNCDIQgiyFDqdiu41+IV+6PBjSGove5M45WXhZb2flv312Z3+qkR:IU1s4FDqdr41hV+6PiWf+6fJ312Z+p

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.incomeelectrix.com
Port:
587
Username:
[email protected]
Password:
tao2012

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.incomeelectrix.com
Port:
587
Username:
[email protected]
Password:
tao2012
Email To:
[email protected]

Targets

- Target
  
  14a7dbc524ff90ed059e716fffdc071cc97d770901f80bb11d4bee5aace67fde
- Size
  
  797KB
- MD5
  
  41a86b771c2ba734138fd135292e31e6
- SHA1
  
  34604125a46c0e22059cc6ec10b1d0f764a927b9
- SHA256
  
  14a7dbc524ff90ed059e716fffdc071cc97d770901f80bb11d4bee5aace67fde
- SHA512
  
  ff69b42311e17a00308b364c2923c35873c7e4a02edaf7414fea21596661c640fe8cc0ad94ee41677d0c304e0f1b05ca3df9ce844dc221855cfe69699fcef10d
- SSDEEP
  
  12288:IU2iNCDIQgiyFDqdiu41+IV+6PBjSGove5M45WXhZb2flv312Z3+qkR:IU1s4FDqdr41hV+6PiWf+6fJ312Z+p
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan