agenttesla | b09a0b160629c46cd40123518cf4beed875c630f8836e2fea5d894c43fd58093 | Triage

Sharing

General

Target

DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Size

861KB
Sample

240426-jy5wjacc7s
MD5

840cbf490ce0600e1057f72949a37c73
SHA1

151c7c81a8f1e9dd889eef12e8c4ca6749495dac
SHA256

b09a0b160629c46cd40123518cf4beed875c630f8836e2fea5d894c43fd58093
SHA512

922e31024ad6994330a528289d3ec3a9584e78b21bc32d8ee5419bc3793911fc4c092b96df0c3c55fe562f6fc761e1d60c8ac229e6c23bf8ab64e2d180c3b3f9
SSDEEP

12288:0YIPXjD9Mo4ALYp92DzclnPtgmDHTtI24666LZwzcu+UEkwE6eeE2:0YIPiEYpQUlPvI251uAuhF5eB

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.clslk.com
Port:
587
Username:
[email protected]
Password:
NUZRATHinam1978
Email To:
[email protected]

Targets

- Target
  
  DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
- Size
  
  861KB
- MD5
  
  840cbf490ce0600e1057f72949a37c73
- SHA1
  
  151c7c81a8f1e9dd889eef12e8c4ca6749495dac
- SHA256
  
  b09a0b160629c46cd40123518cf4beed875c630f8836e2fea5d894c43fd58093
- SHA512
  
  922e31024ad6994330a528289d3ec3a9584e78b21bc32d8ee5419bc3793911fc4c092b96df0c3c55fe562f6fc761e1d60c8ac229e6c23bf8ab64e2d180c3b3f9
- SSDEEP
  
  12288:0YIPXjD9Mo4ALYp92DzclnPtgmDHTtI24666LZwzcu+UEkwE6eeE2:0YIPiEYpQUlPvI251uAuhF5eB
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan