agenttesla

General

Target
Transport Plan.exe
Size 655KB
Sample240820-net25ssfkp
SHA256 4142f2d4724e38b3a0712411f9f6144c9881bdd42cde4f3601a5a4f295b5290e
MD5 7fdc46580498088a1dc91931106cd4db
SHA1 77a284feff8611b989a1cb0ca21d391891baacd9
SHA512 1017c29643815df000bd0f67bd6b6727bef7068b72572fbbb52728867e1a5230d00fe5ac03a527ff4fa8e64cd741a8c7cf7cabf524170be408f5e7b9a9c0c8a3
SSDEEP 12288:xfHaHANG3RciXlV4PMlmvI4HEZdIc0NPlb+ZXG/qtgCE++:dHaHxccV4PEmBHEQ1NPlyZX+oZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
oadc jzrw bmvr klnl

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
oadc jzrw bmvr klnl
Email to
[email protected]

Targets

- Target
  Transport Plan.exe
- Size 655KB
- SHA256 4142f2d4724e38b3a0712411f9f6144c9881bdd42cde4f3601a5a4f295b5290e
- MD5 7fdc46580498088a1dc91931106cd4db
- SHA1 77a284feff8611b989a1cb0ca21d391891baacd9
- SHA512 1017c29643815df000bd0f67bd6b6727bef7068b72572fbbb52728867e1a5230d00fe5ac03a527ff4fa8e64cd741a8c7cf7cabf524170be408f5e7b9a9c0c8a3
- SSDEEP 12288:xfHaHANG3RciXlV4PMlmvI4HEZdIc0NPlb+ZXG/qtgCE++:dHaHxccV4PEmBHEQ1NPlyZX+oZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla guloader credential_access downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 507df75c959e1c9a89febb3f5d5963539895d9a602f4e6ca7898079919a83352
- MD5 232f16c1cb21335fbce6f78ddaf2458c
- SHA1 1c5981b852b3b640c98547074bda081c38859c3f
- SHA512 cb8fb45ffe04e759816cb931223aafa42c15e58f1b35717f59a14c665aa94b48c393ff1a18ac480165ab090fed9226111ae2c3f4e9aead413a105c6f15515227
- SSDEEP 48:a/atDVP10LgQL8QRU8IlmWm7WmnuWK8hSemoMqm18FG49qofMU:lVPFQIqlemWm7WmTaehmus
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
- MD5 d6f54d2cefdf58836805796f55bfc846
- SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
- SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
- SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Guloader,Cloudeye

Credentials from Password Stores: Credentials from Web Browsers

Loads dropped DLL

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6