agenttesla | a5f17947f82d1416344a0a36f7656fb2ad7821237d123174e9ec7949ba4368e4 | Triage

Sharing

General

Target

a5f17947f82d1416344a0a36f7656fb2ad7821237d123174e9ec7949ba4368e4
Size

697KB
Sample

240427-bqbnqagh31
MD5

a5884e74c26e3b35fd9359a738702393
SHA1

76f344c0a8c4d0ec09c48fc0b0960899be16aa3a
SHA256

a5f17947f82d1416344a0a36f7656fb2ad7821237d123174e9ec7949ba4368e4
SHA512

05f3c3d43236ab7ff6f62b15d0da636364fecb342373f52116e18aa857884de0ecaef35e00fc5cfbf946c95587eca71122f157704d392bf06a5889a33efb5b35
SSDEEP

12288:1CH7dpnZbgL3Okl1wT4wIk4BICAq2+nUD3bcpumSPzxfgKnQXERmVLlrkbsZLb6w:1CHPxgDO884DkOR2MpBSPzxoKQURmVLf

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.daipro.com.mx
Port:
587
Username:
[email protected]
Password:
DAIpro123**
Email To:
[email protected]

Targets

- Target
  
  Order Sample Requirement.exe
- Size
  
  797KB
- MD5
  
  f810eab09003409284cb1db8f0dc2c4b
- SHA1
  
  780344e6415405a41d1e5017378d0c3d19386e92
- SHA256
  
  7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b
- SHA512
  
  cfc4e0692b159287e98245686c6c7d77e31b36fbbbed42eb738cdf71be805b2269b4c472272a02946bd483df8efe4ddb191b9945b74aaa6452d60121533f3ea0
- SSDEEP
  
  24576:FklEyBGrRO886HkAT2OpZEPzLogQUjGVL7rklsZ0:xcGrRO8jHk5OpZErLogQ+GVL7Yl00
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan