agenttesla

General

Target

03092024_0058_02092024_Cotizacion actual REF20240829000010 PDF.rar
Size

543KB
Sample

240903-bbxbwatdnh
MD5

019e9e7a97fb65870cf3f72c4f08d7ec
SHA1

52915833f54012f9e84749641daa7a305beffd08
SHA256

f83d313eb9def1ca696c52d00925091761b44d2a9ae5255ac9be5fae92dcd0cf
SHA512

e70468edab5d24a60a6e6182b0cdb9890fe6e2d4c4ea8d3e419600bf544cea9f108c437690bc01173c8b15b0cc2f8b716f6f6da32fa974266f7619ff4623a34f
SSDEEP

12288:/5aVBYCt5V6QbqCiYlsVa6dS/Sy7Jc3GPFYicDUl5qjk:/0EYBb8YKHlyi2KiKW8k

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.controlfire.com.mx
Port:
587
Username:
[email protected]
Password:
+DI9CNZM&Y%W
Email To:
[email protected]

Targets

- Target
  
  Cotizacion actual REF20240829000010 PDF.exe
- Size
  
  1.0MB
- MD5
  
  6f19de2a65a02fd4d1fefc385ca5e57a
- SHA1
  
  a0daaf9c5671344226e800d43b584499fd44406f
- SHA256
  
  1d10b345a34d808d4f18c868435b130d3e4a61d8281af7fbcec02fdaee43e528
- SHA512
  
  3e00c3b1f5214a6f79552f920fd89527214261a02306932fe50943fbf9d441959ba08b3214991cc8e68e291bf6f6dd02fd490fe719e7eb0b688350bf54bb49a6
- SSDEEP
  
  12288:Htb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaVTHssJP6sHSxEN6raB9:Htb20pkaCqT5TBWgNQ7aBl+aB0QB6A
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2