agenttesla

General

Target
21052024_0307_20052024_RFQ-P023102417.xlsx
Size 1.1MB
Sample240521-dmp32sff98
SHA256 165b5c3138801714eac7bc3f21f48adcdf2974931f611c9297de06064f8f96aa
MD5 35c7b17806d7bf19b876494331facdc2
SHA1 e329a04ca002bba4035156d0ede400ac76da3ff9
SHA512 87e6df241de0b6bff063dc13e4017d61eacf539a3fff1a56168d2881fcac120ecd5bb985f8a91f7e75d4dbbdeb2561e930a4e3e5b1efeebeebbd02aa47b3047d
SSDEEP 24576:KUYVW+vMHWCbBmvkFRdtdrzJXfHdzU/GZa4fsIchjz2X7ZD2Kcl:8JLCbBisdDrzcI6P/I7ZSKcl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.fasmacopy.gr
Port
587
Username
[email protected]
Password
Fam28sjd
Email to
[email protected]

Targets

- Target
  21052024_0307_20052024_RFQ-P023102417.xlsx
- Size 1.1MB
- SHA256 165b5c3138801714eac7bc3f21f48adcdf2974931f611c9297de06064f8f96aa
- MD5 35c7b17806d7bf19b876494331facdc2
- SHA1 e329a04ca002bba4035156d0ede400ac76da3ff9
- SHA512 87e6df241de0b6bff063dc13e4017d61eacf539a3fff1a56168d2881fcac120ecd5bb985f8a91f7e75d4dbbdeb2561e930a4e3e5b1efeebeebbd02aa47b3047d
- SSDEEP 24576:KUYVW+vMHWCbBmvkFRdtdrzJXfHdzU/GZa4fsIchjz2X7ZD2Kcl:8JLCbBisdDrzcI6P/I7ZSKcl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2