agenttesla | 974ffbcc0cdba0f379766b343276d721e4093135923c8fa0068d129c0685a69b | Triage

Sharing

General

Target

974ffbcc0cdba0f379766b343276d721e4093135923c8fa0068d129c0685a69b.zip
Size

1.3MB
Sample

240523-rred1aeb61
MD5

44cc138e2a41708a4cbfad61193873cf
SHA1

93d96e5110224850a0f51152bb4e29c9eee06fc6
SHA256

974ffbcc0cdba0f379766b343276d721e4093135923c8fa0068d129c0685a69b
SHA512

78c32cc3c2fdf185890339bb23a40b3ab72a4528cc081e1e6564c238e7b1f7362286a4380635ef6fe3d755c9912db901ed3cae3502a51425efeac3f10e591a93
SSDEEP

24576:ZIe9Usds9wAK/vQeiXZx6iKKEq/WWsnW/KtZ31V9PBSutLFcY/C4S7ZvC:ZIpsowAK/vXU6BkZ0WYZ31jPdtZsZZvC

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  TEKLİF TALEP VE FİYAT TEKLİFİ‮s؜x؜l؜x؜..exe
- Size
  
  2.5MB
- MD5
  
  943b8ec27c9e3997239b317f081ec3e4
- SHA1
  
  c5d9639dfbda1c3fec0f7e7ff9c27790074c0009
- SHA256
  
  09ec4ca4e05a633b0a8114607cc08fd062348051d17f745d483cc3646279722b
- SHA512
  
  7eaf696ca9448de6363903749ef5d3fdb396190b656e8e87f4874a2a00ad19cd5725b072e1514dd90c4ff73eea590629b4e82b5fc084233aba4c44fbde7db490
- SSDEEP
  
  49152:ZP6hSrcCPT0J5Lg31+mYGnKDkTXzTnSPb:iujmmYGnKDkTzTno
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan