agenttesla

General

Target

nsolicitud_de_cotizacion_bat_PDF.lzh.rar
Size

593KB
Sample

240904-py3n3a1gpg
MD5

bfc7527aa84810607f2d058ef84fe1b7
SHA1

e42a75e2ec9ef9ef588b56afb5a7f16ce34539b6
SHA256

43f7ae5d71aa4619e3a5a7127592b06b761f9e374d9f63b6f133cbade3b6d267
SHA512

594d59ad75c2fc0de6a0e68d2733e40fd5a879e335d273fbccfcd3f53f027164dd7e00201d1b911c966414f8246df6951a10c7b21e4105dcb5c1d39da207b7ed
SSDEEP

12288:vwStgtUac5iYuK0SaFVo6jhPgM5MxZ77C8e57TSymdYSO92zOdD1zg:DtgtW5R0tTPgNc847WymF/qxg

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.solucionesmexico.mx
Port:
21
Username:
[email protected]
Password:
dGG^ZYIxX5!B

Targets

- Target
  
  solicitud de cotizacion.bat.PDF.exe
- Size
  
  100.0MB
- MD5
  
  10eb6d5b5d7b28859165c4548c802b37
- SHA1
  
  583365e2d284286ab0d5b08a2d7e3f3c96191f26
- SHA256
  
  fd992317abe43162c2e420c2085eb588011f94e14887704e2baa40ee46388126
- SHA512
  
  f1ee38739c4e3696c9663549be54ec3093b304e9998d6ee78c7234729e2f33e0c67f6508d820f5cc67b53cc520ef93a3e4c6a6c475957a28258e6109390da88a
- SSDEEP
  
  24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8autKPcz5nMzzZ:YTvC/MTQYxsWR7autz
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2