agenttesla | 3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2 | Triage

Sharing

General

Target

ListadeembalajeydireccindeDHL.bat.exe
Size

77.0MB
Sample

240913-yqplxawbjq
MD5

a2eb0cef8229b46e9b9a326289f9b25a
SHA1

ac18afedea384ff1fa3294c19fb05e20bb13966b
SHA256

3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2
SHA512

067f218450301f1d4b40214a42a9b85105d3c528d7056a335e043f44e756622bc1b6345a4135ebcc182516ff62414af3c73747563c5b95c8af713e0bf5a3fcc3
SSDEEP

24576:e4lavt0LkLL9IMixoEgea+rsiDPP/q9MmCS:Jkwkn9IMHea+zDPaPCS

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a
Email To:
[email protected]

Targets

- Target
  
  ListadeembalajeydireccindeDHL.bat.exe
- Size
  
  77.0MB
- MD5
  
  a2eb0cef8229b46e9b9a326289f9b25a
- SHA1
  
  ac18afedea384ff1fa3294c19fb05e20bb13966b
- SHA256
  
  3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2
- SHA512
  
  067f218450301f1d4b40214a42a9b85105d3c528d7056a335e043f44e756622bc1b6345a4135ebcc182516ff62414af3c73747563c5b95c8af713e0bf5a3fcc3
- SSDEEP
  
  24576:e4lavt0LkLL9IMixoEgea+rsiDPP/q9MmCS:Jkwkn9IMHea+zDPaPCS
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan