agenttesla | 03cdb6eead77b0a609a60ddef6c91098950256ecff7218f6c623ba8d5b3db1f2 | Triage

Sharing

General

Target

23e189bd0552c1601a8e0f9ba8d15c86.bin
Size

613KB
Sample

240426-bgzn7agf6w
MD5

6af06a39ddf0516bdd3ff308ce84dbda
SHA1

abaeaeeeba18e01607c982d84fd9190e65b8184b
SHA256

03cdb6eead77b0a609a60ddef6c91098950256ecff7218f6c623ba8d5b3db1f2
SHA512

f1d9c6fe1d54898e5599e0d50de9a5ae1caccef73c8e1bd0d3d56b0c011be438920653eca281d93cd8c931883e3f4b6c95a1e7f50d4116f5c304f8eafdfb8ccd
SSDEEP

12288:mi3ZqAQ0ZdsDBNceF6K3ejCR+6+7jWAHJIWq/wmaCo9RUfO6b:lQv07sDQeFvR+6u6AHJIH9aCo7UfOc

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.pmknycc.in
Port:
587
Username:
[email protected]
Password:
Host@@2020

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pmknycc.in
Port:
587
Username:
[email protected]
Password:
Host@@2020
Email To:
[email protected]

Targets

- Target
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6.exe
- Size
  
  733KB
- MD5
  
  23e189bd0552c1601a8e0f9ba8d15c86
- SHA1
  
  4094f42d511ab76f00f62dad7d40d42015e87651
- SHA256
  
  7468b2db67d7df89dc67b64c6a6a487bc67da85c11e03036b26290d8218101a6
- SHA512
  
  f83e3386b8175359b4b8a6fb9d8e692b1ea427215005064766198fa9667c276117eedff8977a76977604043370d44aa4514605946ae8eb22ec1ef339018c1100
- SSDEEP
  
  12288:bdFkDzZLeZIasnetaFPWpOiDF/5zGSQVQ/Z9l:bdu/ZoIa6etaFPWpOiDF/Oy3l
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan