agenttesla | 182873a3506ff1672872df4e60f3ab692395d4d8aa736815e3f3246a05d22e0a | Triage

Sharing

General

Target

182873a3506ff1672872df4e60f3ab692395d4d8aa736815e3f3246a05d22e0a
Size

776KB
Sample

240524-brxmksgd23
MD5

dbd661f87b1e5ab77f8aa040b0372beb
SHA1

887fe37f8771ae5fb7c7d802dada935d9f26cf67
SHA256

182873a3506ff1672872df4e60f3ab692395d4d8aa736815e3f3246a05d22e0a
SHA512

cda5a9f1d4355051a03b08bb03295027d3ea64067b49e76cee0094f62fa07608a2700f937791612067aaaf06e6c2b144669852d535347f2f872ed55f7cd56913
SSDEEP

12288:rPJPZAXZLD66F/i6macKmdijSATSTO9A8lJPm0T87v08+Dsw/nxS8Kjj7tWmcgQx:rhPZgL2i/i6mxK9BOTOeT7c+F3wmj6F

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ionos.com
Port:
587
Username:
[email protected]
Password:
S@les1@emis@fe2023!
Email To:
[email protected]

Targets

- Target
  
  182873a3506ff1672872df4e60f3ab692395d4d8aa736815e3f3246a05d22e0a
- Size
  
  776KB
- MD5
  
  dbd661f87b1e5ab77f8aa040b0372beb
- SHA1
  
  887fe37f8771ae5fb7c7d802dada935d9f26cf67
- SHA256
  
  182873a3506ff1672872df4e60f3ab692395d4d8aa736815e3f3246a05d22e0a
- SHA512
  
  cda5a9f1d4355051a03b08bb03295027d3ea64067b49e76cee0094f62fa07608a2700f937791612067aaaf06e6c2b144669852d535347f2f872ed55f7cd56913
- SSDEEP
  
  12288:rPJPZAXZLD66F/i6macKmdijSATSTO9A8lJPm0T87v08+Dsw/nxS8Kjj7tWmcgQx:rhPZgL2i/i6mxK9BOTOeT7c+F3wmj6F
Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslaevasionexecutionkeyloggerspywarestealertrojan

behavioral2

agentteslaevasionexecutionkeyloggerspywarestealertrojan