agenttesla | 0d23cb796416bcf04260bdf9d1eef9300de08fff1da13a181c57d065d98bdfae | Triage

Sharing

General

Target

24042024_ithalat_dekont.exe
Size

604KB
Sample

240429-leq95sfb63
MD5

7ddd5227ec23c776e1ad950e60eb37ca
SHA1

7e0c332beb86a7d011e13ede52a77cbfa25740c0
SHA256

0d23cb796416bcf04260bdf9d1eef9300de08fff1da13a181c57d065d98bdfae
SHA512

08c0d3db1462cbf9961bd0f7ba2dda8eba5f907d742e04453c7f87de17c4b036255d6af66028b1726073db55a068cc7f1eb51e59ff8dbf9c4cd3c1329fb0cba3
SSDEEP

12288:7Simbs5M7iO9sV5+JrfeWJm86J6gBh7ta8oZQPid2j9f:7VmbYMr9sYrWB86J6gfM8oZQc2jR

Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  24042024_ithalat_dekont.exe
- Size
  
  604KB
- MD5
  
  7ddd5227ec23c776e1ad950e60eb37ca
- SHA1
  
  7e0c332beb86a7d011e13ede52a77cbfa25740c0
- SHA256
  
  0d23cb796416bcf04260bdf9d1eef9300de08fff1da13a181c57d065d98bdfae
- SHA512
  
  08c0d3db1462cbf9961bd0f7ba2dda8eba5f907d742e04453c7f87de17c4b036255d6af66028b1726073db55a068cc7f1eb51e59ff8dbf9c4cd3c1329fb0cba3
- SSDEEP
  
  12288:7Simbs5M7iO9sV5+JrfeWJm86J6gBh7ta8oZQPid2j9f:7VmbYMr9sYrWB86J6gfM8oZQc2jR
Score

10^/10

agenttesla evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

agentteslaevasionkeyloggerpersistencespywarestealertrojan