agenttesla | d45fb8b6a9053dc25acd244491a1903a073ace51645eb2111e683ed947255177 | Triage

Sharing

General

Target

d45fb8b6a9053dc25acd244491a1903a073ace51645eb2111e683ed947255177
Size

594KB
Sample

240425-b8pnasdb52
MD5

968d9219a92fd5ae96e46adada2dd31e
SHA1

6aa2b203295815e16948ee3429c7964db736d613
SHA256

d45fb8b6a9053dc25acd244491a1903a073ace51645eb2111e683ed947255177
SHA512

5242237f623359d75886dc614a2ca4b8e0d75aacf9558f3b23eacb5a4de79ff819f50f8aca3cf7adafa08f14f88f321a803a8536fb1731be7ad590032b971cf1
SSDEEP

12288:/qG5M7iO9sl5+JrfeAJma6J6sdv7tO8oZeBid6j+H:yyMr9i8rWLa6J6s9s8oZeS6jQ

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  24042024_ithalat_dekont.exe
- Size
  
  604KB
- MD5
  
  7ddd5227ec23c776e1ad950e60eb37ca
- SHA1
  
  7e0c332beb86a7d011e13ede52a77cbfa25740c0
- SHA256
  
  0d23cb796416bcf04260bdf9d1eef9300de08fff1da13a181c57d065d98bdfae
- SHA512
  
  08c0d3db1462cbf9961bd0f7ba2dda8eba5f907d742e04453c7f87de17c4b036255d6af66028b1726073db55a068cc7f1eb51e59ff8dbf9c4cd3c1329fb0cba3
- SSDEEP
  
  12288:7Simbs5M7iO9sV5+JrfeWJm86J6gBh7ta8oZQPid2j9f:7VmbYMr9sYrWB86J6gfM8oZQc2jR
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan