agenttesla | 7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b | Triage

Sharing

General

Target

7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b
Size

797KB
Sample

240427-bp5v6sfh93
MD5

f810eab09003409284cb1db8f0dc2c4b
SHA1

780344e6415405a41d1e5017378d0c3d19386e92
SHA256

7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b
SHA512

cfc4e0692b159287e98245686c6c7d77e31b36fbbbed42eb738cdf71be805b2269b4c472272a02946bd483df8efe4ddb191b9945b74aaa6452d60121533f3ea0
SSDEEP

24576:FklEyBGrRO886HkAT2OpZEPzLogQUjGVL7rklsZ0:xcGrRO8jHk5OpZErLogQ+GVL7Yl00

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.daipro.com.mx
Port:
587
Username:
[email protected]
Password:
DAIpro123**
Email To:
[email protected]

Targets

- Target
  
  7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b
- Size
  
  797KB
- MD5
  
  f810eab09003409284cb1db8f0dc2c4b
- SHA1
  
  780344e6415405a41d1e5017378d0c3d19386e92
- SHA256
  
  7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b
- SHA512
  
  cfc4e0692b159287e98245686c6c7d77e31b36fbbbed42eb738cdf71be805b2269b4c472272a02946bd483df8efe4ddb191b9945b74aaa6452d60121533f3ea0
- SSDEEP
  
  24576:FklEyBGrRO886HkAT2OpZEPzLogQUjGVL7rklsZ0:xcGrRO8jHk5OpZErLogQ+GVL7Yl00
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan