agenttesla

General

Target
14062024_0135_13062024_Unpaid Invoices.zip
Size 616KB
Sample240614-bzy6datfmn
SHA256 a8e761fb8cb4875ad59c0979f16319b26e84b6a181cc9739f4150f46ecc656b8
MD5 6b64a42a98b115816b8e2a8cfc577137
SHA1 7931caf1317ae32dde0715dc81bee05ca706ebd5
SHA512 a34e5d3d6340d9a1abcd75bd7ff97eeb3b05af31a1b1eaf382d7665b2aa2ccfc10f5b16cf0ed3c5926fbd710fb2513f16b2dd4d8fbe91d4d210344c57afff011
SSDEEP 12288:IamGXpvtfr2soi1dkqOh3cAFnEc/+ILguJUEEYxDWYnrR+OyafT8oq:1mOTTmnhsAnEs+IcuJ1EQWYnrRVl7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
vjru ncjq zilj zxwk

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
vjru ncjq zilj zxwk
Email to
[email protected]

Targets

- Target
  tppemand.exe
- Size 933KB
- SHA256 89bf76e33e8a2de09b8d9c5d26b7fd334fb8dad68b8fb2fe619c6ee437ce6466
- MD5 abb335140abdaae9a997dacd7defeb74
- SHA1 f2cc2699492144f89bababb25869b6a8fa929f10
- SHA512 47dce2bfcb3e7765b263178a58451486b30ad9b05e80c5035ea57768a3e07c32545a0f8ca19e5c241ce305ed0736677e489236c50dc4b625f7ce5f9309ef02af
- SSDEEP 24576:XwIC9jSMMMMMHLMMMMMMMMMMMMMoPhKVFSi9cu+IC+J1ESaUnrRbzIW:gIC9jSMMMMMHLMMMMMMMMMMMMMMKVFZD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Mercurialising/Anstesiens/Proclivous/endopterygote.com
- Size 989KB
- SHA256 16e2287e1688be25e89a48506770f88f2da940fb66ab11322bab9c4de9a2935e
- MD5 22917c17a0cf55abe740867314bcba85
- SHA1 b8b667018188617cd410a738885fd5c5968f1bcb
- SHA512 a46afc64e775bbc890976d966891f2cedeea72c4c88edcb57b32261c2659c4c976b6803e9453b6604bae03c2b55817515aa7eedacd3be45588b19690154ec2c1
- SSDEEP 768:Bwk+6hVRRAbffQq9245i0H1h/osZZr+hXUH2JiO/KjFzi5twcHqkw2LshgEAHeVO:cx7XX5O7SlLh0y+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4