agenttesla

General

Target

61eb554843c600f6721a79589a31c5c198308ba747c1504af03f5099f6dfdd69
Size

3KB
Sample

240704-bf868sxfkf
MD5

e69758681e577aa06dfa9425821283b6
SHA1

f9749f35eb63bb619d4990ba3d61221f9e5fe9cc
SHA256

61eb554843c600f6721a79589a31c5c198308ba747c1504af03f5099f6dfdd69
SHA512

be48ad8be7ca3e3166f6d574da5f18d1f0e1eccc5a832d8f8c61724e7a24ba7c2ec3251012a8ff5361393f62b69c8753b96249027d2f9c5bd78ab30d8fd6b53b

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.fosna.net
Port:
21
Username:
[email protected]
Password:
=A+N^@~c]~#I

Targets

- Target
  
  61eb554843c600f6721a79589a31c5c198308ba747c1504af03f5099f6dfdd69
- Size
  
  3KB
- MD5
  
  e69758681e577aa06dfa9425821283b6
- SHA1
  
  f9749f35eb63bb619d4990ba3d61221f9e5fe9cc
- SHA256
  
  61eb554843c600f6721a79589a31c5c198308ba747c1504af03f5099f6dfdd69
- SHA512
  
  be48ad8be7ca3e3166f6d574da5f18d1f0e1eccc5a832d8f8c61724e7a24ba7c2ec3251012a8ff5361393f62b69c8753b96249027d2f9c5bd78ab30d8fd6b53b
Score

10^/10

execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2