agenttesla | e4a1b42efdf45cc9911f4f198aeb981e14043ea23c500cf1e3fa0bb3160948fd | Triage

Sharing

General

Target

12092024081411092024Paymentinvoices02357810354382471.xxe
Size

553KB
Sample

240912-q5nddsxcnj
MD5

31ee5503db45506a0f170f0fbf7d2ff7
SHA1

00c2312e55de6cf763037d7806b4cc6e1421b298
SHA256

e4a1b42efdf45cc9911f4f198aeb981e14043ea23c500cf1e3fa0bb3160948fd
SHA512

3b402a9a157c252bac482e45d19f620068813367b9b9d616f4fb4fa85f472fcd05d64e54f681472985db0defa25f3c1ab13fd3998dfc948f04e4b21d58551051
SSDEEP

12288:f7pys32frdHL+BcKpETyAsZJSgjmaLTndJx74ajgbs:CR+BSTaJSgjmkHxMajgs

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a
Email To:
[email protected]

Targets

- Target
  
  Payment invoices 023578,103543,82471.bat
- Size
  
  77.0MB
- MD5
  
  9548a109a0ad6920b1844cfc74859c60
- SHA1
  
  bb0642abef9db570cb20173295a4483e891f38ef
- SHA256
  
  eb68b23f8d820ce3f7d29fe1313ff9a30a4dd1b6d2585ddde6d2a5822da39e9c
- SHA512
  
  2519b251f9f6b79fab849c3dd6baed76d0f83ac6ca6ee1550f431251d657628f8ec749638ae1de6f418f7f45d58c70b8ce6a4146525e2d0361b00a212e77becd
- SSDEEP
  
  24576:o4lavt0LkLL9IMixoEgeaZGdpR/wzLvsq9MmCS:/kwkn9IMHeaZ9zAaPCS
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan