agenttesla | 9279e4de2ad8ee48cd5ff9e4a8594632d086e9081f7053d02ea9a79695cf70e7 | Triage

Sharing

General

Target

9279e4de2ad8ee48cd5ff9e4a8594632d086e9081f7053d02ea9a79695cf70e7
Size

844KB
Sample

240425-b7beaadc5x
MD5

aaed7ca997aff4e271ac28b540adeca8
SHA1

8c0dc1edf0f1f74fe21f2ee1b0f7dc6ae3809317
SHA256

9279e4de2ad8ee48cd5ff9e4a8594632d086e9081f7053d02ea9a79695cf70e7
SHA512

a049e9a535aee6a7a37cf8b90e8f55096b7fd2b6e2758078d2762ebc6132032c319b81f20c0bc548559ecf1de2c27ad336146f1bf8067d067a8227f123002ab9
SSDEEP

12288:ZGIwGs0SpmBwGXjdX32ogZ+g/yHkZeQzrjKEddyDZNdgc+WU:oXGs0SpmB3XZnMZ4yz/dwDDdg

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cphost09.qhoster.net
Port:
587
Username:
[email protected]
Password:
[email protected]
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
cphost09.qhoster.net
Port:
587
Username:
[email protected]
Password:
[email protected]

Targets

- Target
  
  9279e4de2ad8ee48cd5ff9e4a8594632d086e9081f7053d02ea9a79695cf70e7
- Size
  
  844KB
- MD5
  
  aaed7ca997aff4e271ac28b540adeca8
- SHA1
  
  8c0dc1edf0f1f74fe21f2ee1b0f7dc6ae3809317
- SHA256
  
  9279e4de2ad8ee48cd5ff9e4a8594632d086e9081f7053d02ea9a79695cf70e7
- SHA512
  
  a049e9a535aee6a7a37cf8b90e8f55096b7fd2b6e2758078d2762ebc6132032c319b81f20c0bc548559ecf1de2c27ad336146f1bf8067d067a8227f123002ab9
- SSDEEP
  
  12288:ZGIwGs0SpmBwGXjdX32ogZ+g/yHkZeQzrjKEddyDZNdgc+WU:oXGs0SpmB3XZnMZ4yz/dwDDdg
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan