agenttesla

General

Target
081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab
Size 1.3MB
Sample240608-b7cmcafd2s
SHA256 081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab
MD5 679d86507471cd66f0ba42671aa7de5a
SHA1 9b849cc5235e1ca674a0aa41dc2d6dc6fcc88ebf
SHA512 064d164926a5bb8e0609846df4859260aa4668a2dcbcb4cf0ada408ea4a2f771aaa8b440e5bb496814b659d697e8a2ef88907c96c30d7dd183ff916107d840a4
SSDEEP 6144:DGcHdmE4nFIZxCjmlWMBF8xqgNDjgXn5cEs/DITEDpdatrkEnOIVBOHaJVXqbQ5E:Dn0Sva4NzNjq51Qca8r/FtQK/uu/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.jeepcommerce.rs
Port
21
Username
[email protected]
Password
QtU[bF0Zo#+M

Extracted

Credentials

Protocol
ftp
Host
ftp.jeepcommerce.rs
Port
21
Username
[email protected]
Password
QtU[bF0Zo#+M

Targets

- Target
  081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab
- Size 1.3MB
- SHA256 081dd79296579ad32573e124c60b6dd78cdf5a9591198ea4028ad890a4773dab
- MD5 679d86507471cd66f0ba42671aa7de5a
- SHA1 9b849cc5235e1ca674a0aa41dc2d6dc6fcc88ebf
- SHA512 064d164926a5bb8e0609846df4859260aa4668a2dcbcb4cf0ada408ea4a2f771aaa8b440e5bb496814b659d697e8a2ef88907c96c30d7dd183ff916107d840a4
- SSDEEP 6144:DGcHdmE4nFIZxCjmlWMBF8xqgNDjgXn5cEs/DITEDpdatrkEnOIVBOHaJVXqbQ5E:Dn0Sva4NzNjq51Qca8r/FtQK/uu/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2