agenttesla | 31301b7c5244154518cbef392634fe89e1f232b0e73bbda018ab589663c6d254 | Triage

Sharing

General

Target

Cloud Engine Premium V12.4.exe
Size

14.3MB
Sample

240914-j9xpasvepc
MD5

9bd18a341373270c18de371841573ca8
SHA1

14a403dfd000a95a3f0f817180219646cd3e3b2c
SHA256

31301b7c5244154518cbef392634fe89e1f232b0e73bbda018ab589663c6d254
SHA512

fe7a8de6bf645a7e1ae040eb72e73c8e9b9e7f33a9f130bf736f732cab73c82fdf8f654b14ef44e29951a777a88511637b2f32a76f92ac0104f50159ee8d9f73
SSDEEP

393216:FWg6wsokxF91vjNEo8ecmyy86ShCzMK3DCYFht95:cwjkxx78l6ShCAK3jh75

Score

10^/10

agenttesla discovery evasion execution keylogger spyware stealer trojan

Malware Config

Targets

- Target
  
  Cloud Engine Premium V12.4.exe
- Size
  
  14.3MB
- MD5
  
  9bd18a341373270c18de371841573ca8
- SHA1
  
  14a403dfd000a95a3f0f817180219646cd3e3b2c
- SHA256
  
  31301b7c5244154518cbef392634fe89e1f232b0e73bbda018ab589663c6d254
- SHA512
  
  fe7a8de6bf645a7e1ae040eb72e73c8e9b9e7f33a9f130bf736f732cab73c82fdf8f654b14ef44e29951a777a88511637b2f32a76f92ac0104f50159ee8d9f73
- SSDEEP
  
  393216:FWg6wsokxF91vjNEo8ecmyy86ShCzMK3DCYFht95:cwjkxx78l6ShCAK3jh75
Score

10^/10

agenttesla discovery evasion execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Probable phishing domain
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

agenttesladiscoveryevasionexecutionkeyloggerspywarestealertrojan