agenttesla

General

Target

51df4b4d17fe6aa6d6e1f3376be8354b8bb3bcbe92febeefb103e96380effae8.img
Size

134KB
Sample

240904-bztkwstepa
MD5

06190d840b36aa07354e91a3dbe55607
SHA1

d7986b0829189d87d22c5dcbe7a33e4b28bf9c1e
SHA256

51df4b4d17fe6aa6d6e1f3376be8354b8bb3bcbe92febeefb103e96380effae8
SHA512

71f98085e978ad0f557483d73d836e17ec16887be9e7d7d94465e4e6b368d7c61a5f4fe8ec4c22bf9cb8a3f040c210616a4435c063c12374aefd0fbd2def7ce1
SSDEEP

768:qxcDxkgBoJ1Y932HHDW6cDWS9VJk6nxgfpp1QfiOXr/69X2Ie3STH9s:LFBoDG32HHDW6ca2yyGFOXr/U213Sba

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtps.aruba.it
Port:
587
Username:
[email protected]
Password:
Franco2016!
Email To:
[email protected]

Targets

- Target
  
  Datoteka FAKT_433P200527S1005103.exe
- Size
  
  73KB
- MD5
  
  582ef8e0b652b1079cd95e12ec09cdaa
- SHA1
  
  dbce1ca5ac1cd0af150aef162b5ece63d9454aa1
- SHA256
  
  7923e58a1a1acdb087da37266e7bed734001122b36e8902513e7622d9157d4cd
- SHA512
  
  85488072808b90cf29a46e194b22efd8123cf1be0dba3bfc2713e3591f509187956294927846b7127af6609340f3a8cc4ec21264c61ea580a4a1f2b17cbe2638
- SSDEEP
  
  768:mcDxkgBoJ1Y932HHDW6cDWS9VJk6nxgfpp1QfiOXr/69X2Ie3STH9s:dFBoDG32HHDW6ca2yyGFOXr/U213Sba
Score

10^/10

discovery agenttesla credential_access keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2