agenttesla

General

Target
c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef.xlsx
Size 652KB
Sample240609-lrlkeshf46
SHA256 c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef
MD5 d32ebf59d912022ad03be9f1a79d1622
SHA1 70e185fcd828497aea47489ebd84feb70ed21983
SHA512 f463d70e2773a9b27c43ff24a2fdfc242e55050ba81ea5af34b9984b8aae7697ce0d38135dfefb507efc89c7ca0aba1b6be7040092dd98ce8811b9ab5bb474a5
SSDEEP 12288:eOnWEibaQbA8GS3zY4uKhbO6ZvRM98HaN6N2hN1JAQYVu5RGE41Gw57bhRw:5vQlcfKhrZvRZa42hNKuHGES/O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef.xlsx
- Size 652KB
- SHA256 c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef
- MD5 d32ebf59d912022ad03be9f1a79d1622
- SHA1 70e185fcd828497aea47489ebd84feb70ed21983
- SHA512 f463d70e2773a9b27c43ff24a2fdfc242e55050ba81ea5af34b9984b8aae7697ce0d38135dfefb507efc89c7ca0aba1b6be7040092dd98ce8811b9ab5bb474a5
- SSDEEP 12288:eOnWEibaQbA8GS3zY4uKhbO6ZvRM98HaN6N2hN1JAQYVu5RGE41Gw57bhRw:5vQlcfKhrZvRZa42hNKuHGES/O
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2