agenttesla

General

Target

40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75.bat
Size

7KB
Sample

240429-bktx4sec2x
MD5

6c70e7a8891c5f33997d79d37e79aa37
SHA1

2078349aa37c31d0f378e302d797845a25603961
SHA256

40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75
SHA512

e2ef87750ec9b3683ffc4b13e4e954e4e20d8fdcf79d704ee6a54ee3a2375ad9bfb1557bb6a0dde0d295af7d78d1bcc398606466c49250e2e566f433a5ba01b2
SSDEEP

192:61a/J9MX21bdLSgMulLVo7l+isVXmG5ZWZI:6YJGugJ+ilG5J

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.controlfire.com.mx
Port:
587
Username:
[email protected]
Password:
+DI9CNZM&Y%W
Email To:
[email protected]

Targets

- Target
  
  40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75.bat
- Size
  
  7KB
- MD5
  
  6c70e7a8891c5f33997d79d37e79aa37
- SHA1
  
  2078349aa37c31d0f378e302d797845a25603961
- SHA256
  
  40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75
- SHA512
  
  e2ef87750ec9b3683ffc4b13e4e954e4e20d8fdcf79d704ee6a54ee3a2375ad9bfb1557bb6a0dde0d295af7d78d1bcc398606466c49250e2e566f433a5ba01b2
- SSDEEP
  
  192:61a/J9MX21bdLSgMulLVo7l+isVXmG5ZWZI:6YJGugJ+ilG5J
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Blocklisted process makes network request

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2