agenttesla | 7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6 | Triage

Sharing

General

Target

7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6.exe
Size

733KB
Sample

240425-t4g2rscf3w
MD5

23e189bd0552c1601a8e0f9ba8d15c86
SHA1

4094f42d511ab76f00f62dad7d40d42015e87651
SHA256

7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6
SHA512

f83e3386b8175359b4b8a6fb9d8e692b1ea427215005064766198fa9667c276117eedff8977a76977604043370d44aa4514605946ae8eb22ec1ef339018c1100
SSDEEP

12288:bdFkDzZLeZIasnetaFPWpOiDF/5zGSQVQ/Z9l:bdu/ZoIa6etaFPWpOiDF/Oy3l

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pmknycc.in
Port:
587
Username:
[email protected]
Password:
Host@@2020
Email To:
[email protected]

Targets

- Target
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6.exe
- Size
  
  733KB
- MD5
  
  23e189bd0552c1601a8e0f9ba8d15c86
- SHA1
  
  4094f42d511ab76f00f62dad7d40d42015e87651
- SHA256
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6
- SHA512
  
  f83e3386b8175359b4b8a6fb9d8e692b1ea427215005064766198fa9667c276117eedff8977a76977604043370d44aa4514605946ae8eb22ec1ef339018c1100
- SSDEEP
  
  12288:bdFkDzZLeZIasnetaFPWpOiDF/5zGSQVQ/Z9l:bdu/ZoIa6etaFPWpOiDF/Oy3l
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan