agenttesla | 5141b0042723b654ce6257897c61f78697e0ece7cb9e0b264bd3d6ef3e44d58e | Triage

Sharing

General

Target

5141b0042723b654ce6257897c61f78697e0ece7cb9e0b264bd3d6ef3e44d58e
Size

599KB
Sample

240426-cqq9vahc2z
MD5

19484ac779e101965086a08f75502918
SHA1

efc2e5910c802620776140e2d59b248205d2e170
SHA256

5141b0042723b654ce6257897c61f78697e0ece7cb9e0b264bd3d6ef3e44d58e
SHA512

0bd4c72e5dd4534d385b341f295a725d95a2c085711fede5919acc38cf4be9dd88b4419ba9c324403a61079086aa9968f1083562db8470495dfe6f481969b3fa
SSDEEP

12288:rK90o7oS4VAFziYGqusz/n8ASXI6FL3IswnDNjoTKYw:WG2dMAIYGBCv8VzL4TnBjoOYw

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7131275962:AAE-dJRIntufGLICZWLXrTBpxMw_24XDbCc/

Targets

- Target
  
  5141b0042723b654ce6257897c61f78697e0ece7cb9e0b264bd3d6ef3e44d58e
- Size
  
  599KB
- MD5
  
  19484ac779e101965086a08f75502918
- SHA1
  
  efc2e5910c802620776140e2d59b248205d2e170
- SHA256
  
  5141b0042723b654ce6257897c61f78697e0ece7cb9e0b264bd3d6ef3e44d58e
- SHA512
  
  0bd4c72e5dd4534d385b341f295a725d95a2c085711fede5919acc38cf4be9dd88b4419ba9c324403a61079086aa9968f1083562db8470495dfe6f481969b3fa
- SSDEEP
  
  12288:rK90o7oS4VAFziYGqusz/n8ASXI6FL3IswnDNjoTKYw:WG2dMAIYGBCv8VzL4TnBjoOYw
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan