agenttesla

General

Target
SecuriteInfo.com.Win32.PWSX-gen.13475.26104.exe
Size 620KB
Sample240619-mfdacaydkh
SHA256 e6467422567d07f55c891b1c452dfb2c3c3d24ffa243799c91004cedb8a0dd0c
MD5 a9cc3ce556bed1f4f023dfb299b54d32
SHA1 61eacf083e3a9fdb55825ecaedcac6596746d3f7
SHA512 dd446826fe672b9d162f2f18f08cfcc2ffa0e8586498423e27cbbd00737d5e31b0ecc031ec6cb4d416f1547718c8bc10e615815b4525a25fafb07ead0cf4fd32
SSDEEP 12288:+tX62p8VeLrV6/dcfRGwvjTJGGyHwMmgjjhz3vVe0r8N3j7D:uzyKE/dcfgcIzHM+hLvboNT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.trisquarespl.com
Port
587
Username
[email protected]
Password
^uw)^EY5
Email to
[email protected]

Targets

- Target
  SecuriteInfo.com.Win32.PWSX-gen.13475.26104.exe
- Size 620KB
- SHA256 e6467422567d07f55c891b1c452dfb2c3c3d24ffa243799c91004cedb8a0dd0c
- MD5 a9cc3ce556bed1f4f023dfb299b54d32
- SHA1 61eacf083e3a9fdb55825ecaedcac6596746d3f7
- SHA512 dd446826fe672b9d162f2f18f08cfcc2ffa0e8586498423e27cbbd00737d5e31b0ecc031ec6cb4d416f1547718c8bc10e615815b4525a25fafb07ead0cf4fd32
- SSDEEP 12288:+tX62p8VeLrV6/dcfRGwvjTJGGyHwMmgjjhz3vVe0r8N3j7D:uzyKE/dcfgcIzHM+hLvboNT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2