agenttesla

General

Target

a553c6f4d383a61e06264584b70ed7fbc509ac278d2206a62ad1971902854ea9
Size

735KB
Sample

240728-bk9nkazaln
MD5

7643361991eaf517de36740fb6154b67
SHA1

7665b347f0a6e6a9cf3e28eb1336c0cde19f8854
SHA256

a553c6f4d383a61e06264584b70ed7fbc509ac278d2206a62ad1971902854ea9
SHA512

79a2e204b1cacf7de4298f28dbe6583b45ed23350f667934d354c5e03a111cca1019fd946dcaa22aafa66058387e99337cc9982643b00a9766a3fc96c329ae4f
SSDEEP

12288:VsHzOUNUSB/o5LsI1uwajJ5yvv1l2DkTDBaufMeOwmmBNDk28IqYh2KrbKKHOuqT:MiUmSB/o5d1ubcvfT9zswmmA28fYUImP

Score

10^/10

Malware Config

Targets

- Target
  
  a553c6f4d383a61e06264584b70ed7fbc509ac278d2206a62ad1971902854ea9
- Size
  
  735KB
- MD5
  
  7643361991eaf517de36740fb6154b67
- SHA1
  
  7665b347f0a6e6a9cf3e28eb1336c0cde19f8854
- SHA256
  
  a553c6f4d383a61e06264584b70ed7fbc509ac278d2206a62ad1971902854ea9
- SHA512
  
  79a2e204b1cacf7de4298f28dbe6583b45ed23350f667934d354c5e03a111cca1019fd946dcaa22aafa66058387e99337cc9982643b00a9766a3fc96c329ae4f
- SSDEEP
  
  12288:VsHzOUNUSB/o5LsI1uwajJ5yvv1l2DkTDBaufMeOwmmBNDk28IqYh2KrbKKHOuqT:MiUmSB/o5d1ubcvfT9zswmmA28fYUImP
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Credentials from Password Stores: Credentials from Web Browsers

Drops startup file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2