agenttesla

General

Target
Upit za prevoz 28 08 2024 1037 Agrorit d.o.o.exe
Size 22KB
Sample240829-l2tzjsvhrb
SHA256 2debf2cfc6d46684b470e7be05a95b5de3675f16b61b07a23469d1b61b29a6fc
MD5 46256f90a589c039c8059b2ddbc8b928
SHA1 7fb1395b64e91679f34d3d69f3292af0d0971e48
SHA512 4a916c79a10c123e6c4efe4fc07921e590baa158588248c592f7de73441a585e2bd8ad27a793df497a4b58de57e24772ada68419e7721e87d6638de1e3baadcc
SSDEEP 192:a7I/6NnPaDEG9nwOyqrNO9mlAUQLYLFHDwiB1tx0qN6lGQq+2tj7R7/45mlnEgog:JmnCDYOISHsi70StZ/pov
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtps.aruba.it
Port
587
Username
[email protected]
Password
Franco2016!
Email to
[email protected]

Targets

- Target
  Upit za prevoz 28 08 2024 1037 Agrorit d.o.o.exe
- Size 22KB
- SHA256 2debf2cfc6d46684b470e7be05a95b5de3675f16b61b07a23469d1b61b29a6fc
- MD5 46256f90a589c039c8059b2ddbc8b928
- SHA1 7fb1395b64e91679f34d3d69f3292af0d0971e48
- SHA512 4a916c79a10c123e6c4efe4fc07921e590baa158588248c592f7de73441a585e2bd8ad27a793df497a4b58de57e24772ada68419e7721e87d6638de1e3baadcc
- SSDEEP 192:a7I/6NnPaDEG9nwOyqrNO9mlAUQLYLFHDwiB1tx0qN6lGQq+2tj7R7/45mlnEgog:JmnCDYOISHsi70StZ/pov
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla credential_access keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2