agenttesla | ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36 | Triage

Sharing

General

Target

Offer Required.bat.exe
Size

777KB
Sample

240522-j3vlcshb72
MD5

d96260136e9989c3ee56e2fef804175e
SHA1

ba76e6c03a5485166cf0bc9bfd7b5ff34a684a5b
SHA256

ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36
SHA512

4c6dd05630206e2a9292bb0c569f4f450aa6b3be749e056eddd42f86cfe5f2790c8c305e0f5e31a12ee8e90522767563a195a90d75bb2043476a26d54494649c
SSDEEP

12288:t5Zhg/9yOnhNzHxepY9oCfO2iiCw+vokWCotbleaQVBmWJzrGtLAgReWjGT43Zqb:+ThNzg29oGO2iaYWjtb5G/

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.desirebeverage.com
Port:
587
Username:
[email protected]
Password:
Ecom@779
Email To:
[email protected]

Targets

- Target
  
  Offer Required.bat.exe
- Size
  
  777KB
- MD5
  
  d96260136e9989c3ee56e2fef804175e
- SHA1
  
  ba76e6c03a5485166cf0bc9bfd7b5ff34a684a5b
- SHA256
  
  ab8187e1651648d7f5d1906536e0dc09680dbc18cb311ef5686fe2049659da36
- SHA512
  
  4c6dd05630206e2a9292bb0c569f4f450aa6b3be749e056eddd42f86cfe5f2790c8c305e0f5e31a12ee8e90522767563a195a90d75bb2043476a26d54494649c
- SSDEEP
  
  12288:t5Zhg/9yOnhNzHxepY9oCfO2iiCw+vokWCotbleaQVBmWJzrGtLAgReWjGT43Zqb:+ThNzg29oGO2iaYWjtb5G/
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaexecutionkeyloggerspywarestealertrojan

behavioral2

agentteslaexecutionkeyloggerspywarestealertrojan