agenttesla | 78bbe986cef181f7f325f33ebf619e8b09f630a0c3a2d921f8460368cdda1d34 | Triage

Sharing

General

Target

78bbe986cef181f7f325f33ebf619e8b09f630a0c3a2d921f8460368cdda1d34
Size

2.8MB
Sample

240524-b3hb2agh38
MD5

6d2ccb6798a5074206c214bad67de3a3
SHA1

69f86ba5d5a46f536c6b07a52537d2a3cbb6454a
SHA256

78bbe986cef181f7f325f33ebf619e8b09f630a0c3a2d921f8460368cdda1d34
SHA512

484aecc832c987e152b71ec1408389b0a8473d4bb0aefbc03cc930912d1cd2cb85c2880294a878de72d036e4d589d7e86fc434a71e9df8b0cc3e41ccd91d0bd1
SSDEEP

49152:1Mi478roH8jo8ycdddddddSdddddddSdddddddSdddddddSdddddddSdddddddSU:1MiZof8yd

Score

10^/10

agenttesla evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.visalinkpathways.com
Port:
587
Username:
[email protected]
Password:
newton@233

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.visalinkpathways.com
Port:
587
Username:
[email protected]
Password:
newton@233
Email To:
[email protected]

Targets

- Target
  
  78bbe986cef181f7f325f33ebf619e8b09f630a0c3a2d921f8460368cdda1d34
- Size
  
  2.8MB
- MD5
  
  6d2ccb6798a5074206c214bad67de3a3
- SHA1
  
  69f86ba5d5a46f536c6b07a52537d2a3cbb6454a
- SHA256
  
  78bbe986cef181f7f325f33ebf619e8b09f630a0c3a2d921f8460368cdda1d34
- SHA512
  
  484aecc832c987e152b71ec1408389b0a8473d4bb0aefbc03cc930912d1cd2cb85c2880294a878de72d036e4d589d7e86fc434a71e9df8b0cc3e41ccd91d0bd1
- SSDEEP
  
  49152:1Mi478roH8jo8ycdddddddSdddddddSdddddddSdddddddSdddddddSdddddddSU:1MiZof8yd
Score

10^/10

agenttesla evasion execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaevasionexecutionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslaevasionexecutionkeyloggerpersistencespywarestealertrojan