agenttesla | 3154656cabe028daaaa85185fe521658adf8e39c36578a21b609c47f19d5dce4 | Triage

Sharing

General

Target

3154656cabe028daaaa85185fe521658adf8e39c36578a21b609c47f19d5dce4.rar
Size

689KB
Sample

240522-vsxhraab86
MD5

eff899596f89f9523de9518161d4c946
SHA1

b7ee10a8fecc79a74d4064caf77738e8e24d16d2
SHA256

3154656cabe028daaaa85185fe521658adf8e39c36578a21b609c47f19d5dce4
SHA512

897a0b0147d00a81847ff48e2295e255a27f6bfd71b503cc932c1b8dc8a2308dbc994a9accaa77e41cc1b038675865bf718238b58db47e8e0002a4515538fb0b
SSDEEP

12288:U3peYtRLXy7g/RgHaS6rGcUdSMudh0+czW7HQ1M/G3uzyTyvYyFd7AJLtV:0IY3LicJW6G3EbdPs6HpKcBd7+5V

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.springandsummer.lk
Port:
587
Username:
[email protected]
Password:
anu##323
Email To:
[email protected]

Targets

- Target
  
  URGENT REQUEST FOR QUOTATION.exe
- Size
  
  775KB
- MD5
  
  3fd59a26eb8f645ac1f88e2ec2a3137a
- SHA1
  
  eb5135dd863bcfefa4a8e9e2fbd686068d6354e4
- SHA256
  
  785b8115d62f971593bacb7ddf5e0f0fa03ad2d3a077b91c88de788ee83f62b9
- SHA512
  
  486d81f9f07bd156ad5f1bcf127e4484399f8d43d1a6cfb09919f0971b276477c8bb5e7debd43087739c8c462488804f299017a043916c88ffd2318ecf7559d0
- SSDEEP
  
  24576:IWtb3BEXqdGFXcEm5t3bpP0PHBU4Z1ZM3fyD:TZBEqGKEm5HEhT06D
Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaexecutionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslaexecutionkeyloggerpersistencespywarestealertrojan