agenttesla | cbb075838fd18b0c403c60da16f9d365874e56fc052db58f8d8c8491654ebea6 | Triage

Sharing

General

Target

cbb075838fd18b0c403c60da16f9d365874e56fc052db58f8d8c8491654ebea6
Size

702KB
Sample

240727-brlv3s1amb
MD5

a383dc759f45c9fa5dd628040a2c8dc7
SHA1

95462520b39cbdb2bd85473813d4f2ce3b0d8bfb
SHA256

cbb075838fd18b0c403c60da16f9d365874e56fc052db58f8d8c8491654ebea6
SHA512

831580642e1a9c0bb25e783837bb06909ca87777b1e8689a582e063a03117bf8b890481a7761177beab27715686591f388a7cb7fddc4312a4d167b60ddd378c9
SSDEEP

12288:BwQb6pykVjq2ETUvdoe1fa6E2Ana/nO5AU+G49MqIXOMO38X9v+IYLzmkR:qQb6pykVHoe1S6E2Aa/O5dQ9OOMHVYX9

Score

10^/10

agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.springandsummer.lk
Port:
587
Username:
[email protected]
Password:
anu##323
Email To:
[email protected]

Targets

- Target
  
  cbb075838fd18b0c403c60da16f9d365874e56fc052db58f8d8c8491654ebea6
- Size
  
  702KB
- MD5
  
  a383dc759f45c9fa5dd628040a2c8dc7
- SHA1
  
  95462520b39cbdb2bd85473813d4f2ce3b0d8bfb
- SHA256
  
  cbb075838fd18b0c403c60da16f9d365874e56fc052db58f8d8c8491654ebea6
- SHA512
  
  831580642e1a9c0bb25e783837bb06909ca87777b1e8689a582e063a03117bf8b890481a7761177beab27715686591f388a7cb7fddc4312a4d167b60ddd378c9
- SSDEEP
  
  12288:BwQb6pykVjq2ETUvdoe1fa6E2Ana/nO5AU+G49MqIXOMO38X9v+IYLzmkR:qQb6pykVHoe1S6E2Aa/O5dQ9OOMHVYX9
Score

10^/10

agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan