agenttesla | 0eb51ec984a24a6b477f978a784c3bcbda534779b9c9dcbff4e2cd299b0a9109 | Triage

Sharing

General

Target

0eb51ec984a24a6b477f978a784c3bcbda534779b9c9dcbff4e2cd299b0a9109
Size

618KB
Sample

240523-bgskwafh2x
MD5

3f40d72c0e675dc5615c5ecc2edd94fd
SHA1

211eab98acaa8231eefd5398274b0b965501e399
SHA256

0eb51ec984a24a6b477f978a784c3bcbda534779b9c9dcbff4e2cd299b0a9109
SHA512

4a1dcdcbe02faf93e23b847e1aa52e2d281f1018c0fac5e77a61d1b728466603d6f6f0097c99f53a4fc4a41993a35e7fa6ed129b0f29abd35df7e5efa6dc62b1
SSDEEP

12288:hLPGQ7ve2zVD4KrR3CzgtgdbIim6lTL600g1uwPAfS+x9geRUjJFPY0Wh:te08Krh1glIimGTe03qdKJBfY

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ionos.com
Port:
587
Username:
[email protected]
Password:
S@les1@emis@fe2023!
Email To:
[email protected]

Targets

- Target
  
  0eb51ec984a24a6b477f978a784c3bcbda534779b9c9dcbff4e2cd299b0a9109
- Size
  
  618KB
- MD5
  
  3f40d72c0e675dc5615c5ecc2edd94fd
- SHA1
  
  211eab98acaa8231eefd5398274b0b965501e399
- SHA256
  
  0eb51ec984a24a6b477f978a784c3bcbda534779b9c9dcbff4e2cd299b0a9109
- SHA512
  
  4a1dcdcbe02faf93e23b847e1aa52e2d281f1018c0fac5e77a61d1b728466603d6f6f0097c99f53a4fc4a41993a35e7fa6ed129b0f29abd35df7e5efa6dc62b1
- SSDEEP
  
  12288:hLPGQ7ve2zVD4KrR3CzgtgdbIim6lTL600g1uwPAfS+x9geRUjJFPY0Wh:te08Krh1glIimGTe03qdKJBfY
Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslaevasionexecutionkeyloggerspywarestealertrojan

behavioral2

agentteslaevasionexecutionkeyloggerspywarestealertrojan