agenttesla | 52adc27e384cb4ae0d0e096792526ca660f8b2a42e60d69ffd44e67def0fcf12 | Triage

Sharing

General

Target

52adc27e384cb4ae0d0e096792526ca660f8b2a42e60d69ffd44e67def0fcf12.exe
Size

748KB
Sample

240522-r7thvseh83
MD5

a7666685c69267f2f9108e319cd0cd38
SHA1

feac316461451bcaf6a64ea92217ad8046808844
SHA256

52adc27e384cb4ae0d0e096792526ca660f8b2a42e60d69ffd44e67def0fcf12
SHA512

49ad3a8d3a2ebf64c9feaddf916c2c20466bc355116177c81eaf045b251a2e034154832f60b9d40cde2b919e9d818bef3fc97588f95ab455af3971d823a1ddf0
SSDEEP

12288:Tzln6yWn7fcpVZlu/6uHKbRLj4+62FGPstWYfMXmxk5QI7O/125khKzwcY+Dw3:Nn698VVYeLL62F0+WGam2qnUkwzwcQ

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.diginetbd.net
Port:
587
Username:
[email protected]
Password:
efs321##@@
Email To:
[email protected]

Targets

- Target
  
  52adc27e384cb4ae0d0e096792526ca660f8b2a42e60d69ffd44e67def0fcf12.exe
- Size
  
  748KB
- MD5
  
  a7666685c69267f2f9108e319cd0cd38
- SHA1
  
  feac316461451bcaf6a64ea92217ad8046808844
- SHA256
  
  52adc27e384cb4ae0d0e096792526ca660f8b2a42e60d69ffd44e67def0fcf12
- SHA512
  
  49ad3a8d3a2ebf64c9feaddf916c2c20466bc355116177c81eaf045b251a2e034154832f60b9d40cde2b919e9d818bef3fc97588f95ab455af3971d823a1ddf0
- SSDEEP
  
  12288:Tzln6yWn7fcpVZlu/6uHKbRLj4+62FGPstWYfMXmxk5QI7O/125khKzwcY+Dw3:Nn698VVYeLL62F0+WGam2qnUkwzwcQ
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaexecutionkeyloggerspywarestealertrojan

behavioral2

agentteslaexecutionkeyloggerspywarestealertrojan