agenttesla

General

Target

08b192739d727600f2ce9c8acb307b5e1e7ff3328dbff1120f6b6bd1a5cb6420.rar
Size

632KB
Sample

240823-kv6jbsvdmh
MD5

87fa046d12dacbdb2b6c5425a6c8fb99
SHA1

5431651846d0be7ac288173a6d617dbc3359e5a2
SHA256

08b192739d727600f2ce9c8acb307b5e1e7ff3328dbff1120f6b6bd1a5cb6420
SHA512

6c5f5e567572386ed201c3c37735b31c8b01b2ff9d8266ecf1bd99f2232502e5790975660ab33247c2f561bc6c38d24d1bc070935d481f06a9ba254dd6b25717
SSDEEP

12288:5/3J9MLI0Sogq1JaaGq2YLXeKw3xftAnQCtxyFFC0kaNuttLAIq9k7Re:5/bMLhZ9JHN/Lu158IkaNmWIV7Re

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.solucionesmexico.mx
Port:
21
Username:
[email protected]
Password:
dGG^ZYIxX5!B

Targets

- Target
  
  orden de compra.bat.exe
- Size
  
  100.0MB
- MD5
  
  d70380ba5041f65cbd3a366d94b8e84d
- SHA1
  
  e156796c452b563870247b8a3a585cec868eafe1
- SHA256
  
  112c9ef5449597a16346113af162687e26c9d4fa2cdd71e603a527c1c9cd4807
- SHA512
  
  75bbac3fe6dd8e9e34e33ece6b9acfb8bdd8d8e00470b6c0fc43fb4069210a0b1150b236a7de60b786307b0f7e4f5640716d6da72c9d43effbd378dfb8eb0e8b
- SSDEEP
  
  24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8aGJPPvKIR7RU:HTvC/MTQYxsWR7aGxPLJR
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2