agenttesla

Sharing

Copy URL Twitter E-mail

General

Target
03062024_1634_30052024_Attachments.zip
Size 1.6MB
Sample240603-t3btcsdf78
SHA256 92dabaf9d4995f7238d9f570641d227ba5a5f7199813f976bd0b4fcc0abd3435
MD5 76710656e627b36dd5de0aa1c89ed214
SHA1 a26a2366ca9459f9e5b3e76477b9530922537f07
SHA512 d5563b471fa74c0dcbd78669e222248d4877ab914e1a8f4349413d49d81259a8bcaf18eeba88847a7b514eac694d6b40338f7a61a0d98a8c218194d6c339df41
SSDEEP 49152:Hhk/wshjRka3c0xFfKT2LqygFqQasuuDgT9b+Htk+cyBoXs:mIsfuDgT9b+hBR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot7135973864:AAGVqtrGeLysm0FYcz68sQIn3nL2a6CxjMc/

Targets

- Target
  INVOICE07.bat
- Size 540KB
- SHA256 e575145995f725fbaecc1b95c73ec0fbdad3117e1f492dc8d93ad076f5ad2da1
- MD5 1952a79579272db52a814baf57821f90
- SHA1 3fcfb6c3d2c08e840d758e905c2f304ec39ca9f3
- SHA512 088de9db26c4eda94bb71a5379118418c06bcb46d8ccce7d1da2719c8d742e8347a4dfde9f73afbb362ef461a0af159408d9150adc8653f6e5a3507408eb6a93
- SSDEEP 12288:xToPjPt8r1cxIMTOQo5Xq4PpsXis9Jhqd8FJVqzT+53xH:xeWrOa4UaYpsXlJIdwSIZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  INVOICE07.bat
- Size 540KB
- SHA256 e575145995f725fbaecc1b95c73ec0fbdad3117e1f492dc8d93ad076f5ad2da1
- MD5 1952a79579272db52a814baf57821f90
- SHA1 3fcfb6c3d2c08e840d758e905c2f304ec39ca9f3
- SHA512 088de9db26c4eda94bb71a5379118418c06bcb46d8ccce7d1da2719c8d742e8347a4dfde9f73afbb362ef461a0af159408d9150adc8653f6e5a3507408eb6a93
- SSDEEP 12288:xToPjPt8r1cxIMTOQo5Xq4PpsXis9Jhqd8FJVqzT+53xH:xeWrOa4UaYpsXlJIdwSIZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  InvoiceConfirmation3.bat
- Size 540KB
- SHA256 18ff8049e5eac05d3f1bf7d414664845edd76f5393630aa463566476e45b9985
- MD5 af29b01f9517f84f7d1794a3c5a987d5
- SHA1 17f8776ea38c0eb07915cf1ab4e52a2c87ec70cd
- SHA512 29afff43ff59985eb4d65463cf7b8eaa6a82ae508cce66222707cab084d25bed77a45b7f85ec13e91545827f76bde014794b7ccf77f0df44b815df6b8d76953d
- SSDEEP 12288:2Nu+DeVdU51H++iCBdiQslfVMLOzcU+MEJXMHwXUIXkZsCSbluwG9XJec8SmC:t+aVK51HzBdeqLOIM8XfUXFYk7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral5 behavioral6
- Target
  InvoiceConfirmation3.bat
- Size 540KB
- SHA256 18ff8049e5eac05d3f1bf7d414664845edd76f5393630aa463566476e45b9985
- MD5 af29b01f9517f84f7d1794a3c5a987d5
- SHA1 17f8776ea38c0eb07915cf1ab4e52a2c87ec70cd
- SHA512 29afff43ff59985eb4d65463cf7b8eaa6a82ae508cce66222707cab084d25bed77a45b7f85ec13e91545827f76bde014794b7ccf77f0df44b815df6b8d76953d
- SSDEEP 12288:2Nu+DeVdU51H++iCBdiQslfVMLOzcU+MEJXMHwXUIXkZsCSbluwG9XJec8SmC:t+aVK51HzBdeqLOIM8XfUXFYk7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AgentTesla

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AgentTesla

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AgentTesla

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8