agenttesla | 3908bfd056ef656e963f85ae88687456614af5df3174785fc12864ed0bd5b5fe | Triage

Sharing

General

Target

d47f2a878c8df44243db55f77eba4144_JaffaCakes118
Size

455KB
Sample

240908-q2lema1fre
MD5

d47f2a878c8df44243db55f77eba4144
SHA1

6c13d2c78c0435bea621d08e40b5bec744cbd062
SHA256

3908bfd056ef656e963f85ae88687456614af5df3174785fc12864ed0bd5b5fe
SHA512

7c2ec2fb6b61ca033e894a675ea596101e40011dd458bc252cbddfa3f5141847bddd262695b39d4a61fd26af11590ae8d186ae750ef686fa1116c2b27ceb2439
SSDEEP

12288:JpnXBbR+DSeYBljju9RpOD/kBwcmNao06DE:bXBfjypnwJ

Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  d47f2a878c8df44243db55f77eba4144_JaffaCakes118
- Size
  
  455KB
- MD5
  
  d47f2a878c8df44243db55f77eba4144
- SHA1
  
  6c13d2c78c0435bea621d08e40b5bec744cbd062
- SHA256
  
  3908bfd056ef656e963f85ae88687456614af5df3174785fc12864ed0bd5b5fe
- SHA512
  
  7c2ec2fb6b61ca033e894a675ea596101e40011dd458bc252cbddfa3f5141847bddd262695b39d4a61fd26af11590ae8d186ae750ef686fa1116c2b27ceb2439
- SSDEEP
  
  12288:JpnXBbR+DSeYBljju9RpOD/kBwcmNao06DE:bXBfjypnwJ
Score

10^/10

discovery agenttesla collection credential_access keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan