agenttesla | a48161c9f7d80c248c41585a431a7b23aaa1098ceb87c37e2d2a36f7a0c23593 | Triage

Sharing

General

Target

a48161c9f7d80c248c41585a431a7b23aaa1098ceb87c37e2d2a36f7a0c23593.exe
Size

1.4MB
Sample

240904-qthzja1bql
MD5

b7d456bae3313c0fc5a72a63fbefeec2
SHA1

74a6c8c4be4055b27018d1c3194c4863328e5dcc
SHA256

a48161c9f7d80c248c41585a431a7b23aaa1098ceb87c37e2d2a36f7a0c23593
SHA512

8af5cf588c6a92b9d1cba0ed3f7b5a8327c575df4589f7e20c3a58b84590f54a82f09b2ed6b839981c001f3b67a516e08fbe799ad0d113052e10988e4c0cbaef
SSDEEP

24576:9tb20pkaCqT5TBWgNQ7aO6+uvcUSm6AcUykCd+wp9izOaVMp0O6A:uVg5tQ7aT1R6VzEzxV25

Score

10^/10

agenttesla collection credential_access discovery keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://209.127.20.21/ori/
Port:
21
Username:
control
Password:
Abobo123#

Protocol: ftp
Host:
ftp://209.127.20.21/ori/
Port:
21
Username:
control
Password:
Abobo123#

Targets

- Target
  
  a48161c9f7d80c248c41585a431a7b23aaa1098ceb87c37e2d2a36f7a0c23593.exe
- Size
  
  1.4MB
- MD5
  
  b7d456bae3313c0fc5a72a63fbefeec2
- SHA1
  
  74a6c8c4be4055b27018d1c3194c4863328e5dcc
- SHA256
  
  a48161c9f7d80c248c41585a431a7b23aaa1098ceb87c37e2d2a36f7a0c23593
- SHA512
  
  8af5cf588c6a92b9d1cba0ed3f7b5a8327c575df4589f7e20c3a58b84590f54a82f09b2ed6b839981c001f3b67a516e08fbe799ad0d113052e10988e4c0cbaef
- SSDEEP
  
  24576:9tb20pkaCqT5TBWgNQ7aO6+uvcUSm6AcUykCd+wp9izOaVMp0O6A:uVg5tQ7aT1R6VzEzxV25
Score

10^/10

agenttesla collection credential_access discovery keylogger persistence privilege_escalation spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectioncredential_accessdiscoverykeyloggerpersistenceprivilege_escalationspywarestealertrojan

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerpersistenceprivilege_escalationspywarestealertrojan