agenttesla | 1d567afd69f78d8338175c52071081129e491f08830f40ce140e684305499755 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1d567afd69f78d8338175c52071081129e491f08830f40ce140e684305499755
Size

2.0MB
Sample

240802-bd377s1cqe
MD5

7878b4b4fad1adf2f1f6d6a94539d29c
SHA1

721be6b08e6c3e87407d845ff59b961f6a4cdbfe
SHA256

1d567afd69f78d8338175c52071081129e491f08830f40ce140e684305499755
SHA512

3ae5882ba0911502a78a2a9216eb934e54d20a5802df1e157f7d6192c6cf67e36d57df788b930a3def00aec8beb68c46ad76f61d614d795c8f102659e722ab30
SSDEEP

49152:tB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R80DYWg1spb673t5s1cc:haRrFCI3973Ts1cc

Score

10^/10

agenttesla credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftps4.us.freehostia.com
Port:
21
Username:
alamah13
Password:
8yB4zILn1@

Extracted

Credentials

Protocol: ftp
Host:
ftps4.us.freehostia.com
Port:
21
Username:
alamah13
Password:
8yB4zILn1@

Targets

- Target
  
  1d567afd69f78d8338175c52071081129e491f08830f40ce140e684305499755
- Size
  
  2.0MB
- MD5
  
  7878b4b4fad1adf2f1f6d6a94539d29c
- SHA1
  
  721be6b08e6c3e87407d845ff59b961f6a4cdbfe
- SHA256
  
  1d567afd69f78d8338175c52071081129e491f08830f40ce140e684305499755
- SHA512
  
  3ae5882ba0911502a78a2a9216eb934e54d20a5802df1e157f7d6192c6cf67e36d57df788b930a3def00aec8beb68c46ad76f61d614d795c8f102659e722ab30
- SSDEEP
  
  49152:tB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R80DYWg1spb673t5s1cc:haRrFCI3973Ts1cc
Score

10^/10

agenttesla credential_access discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan