agenttesla | e0a879d49cabbd517cd611b81cd5935e4f024532aa43aeba310650ce2411850c | Triage

Sharing

General

Target

Product Requirement Specification.exe
Size

717KB
Sample

240524-sdvz9sac58
MD5

429730ecefe80ea9b11f3265c138d07a
SHA1

bda184f72851ae98c67847a94e58abb80ae18d38
SHA256

e0a879d49cabbd517cd611b81cd5935e4f024532aa43aeba310650ce2411850c
SHA512

5120a18e2ada665695870f12a79540958103cbf7ee5f3f137c7a2242a9b7843294c5a390caf5a1ce8ec98899d8fccb09b1372d85281682ecfcca0256371f9df0
SSDEEP

12288:7qMVGPNlfw5660NXE6vEylfnrZ8G+yoLd67a28KSo4wei44yql8DOJUM:7WP48X/vEylfn18aoLd6fSozLWHOWM

Score

10^/10

agenttesla evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
business29.web-hosting.com
Port:
587
Username:
[email protected]
Password:
7.s8.{OnUP(S
Email To:
[email protected]

Targets

- Target
  
  Product Requirement Specification.exe
- Size
  
  717KB
- MD5
  
  429730ecefe80ea9b11f3265c138d07a
- SHA1
  
  bda184f72851ae98c67847a94e58abb80ae18d38
- SHA256
  
  e0a879d49cabbd517cd611b81cd5935e4f024532aa43aeba310650ce2411850c
- SHA512
  
  5120a18e2ada665695870f12a79540958103cbf7ee5f3f137c7a2242a9b7843294c5a390caf5a1ce8ec98899d8fccb09b1372d85281682ecfcca0256371f9df0
- SSDEEP
  
  12288:7qMVGPNlfw5660NXE6vEylfnrZ8G+yoLd67a28KSo4wei44yql8DOJUM:7WP48X/vEylfn18aoLd6fSozLWHOWM
Score

10^/10

agenttesla evasion execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslaevasionexecutionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslaevasionexecutionkeyloggerpersistencespywarestealertrojan