agenttesla

General

Target

18092024_1403_18092024_PIQ9876009000.doc.lz
Size

1006KB
Sample

240918-rcp7yswaln
MD5

cfc95e87581022cd2760960b2dbfce03
SHA1

6d69914cba8ed2f556b9128b9b26f657efb6baf2
SHA256

d277fb45877d0214b31219f5b4b3d489972fd79d37f440a494f2937a56674063
SHA512

19fdfca83e51a2d83f70b4e22de56586661460e3c9c5301cb6ef07435f7b0d6ffd69bd0bcacf1c6e35ad32f606fe5873da5aedab538725d516fc664143ee2d21
SSDEEP

24576:pGigWLYs/PQGqsFAPX+wwYCcvRFvFd00Ujzleor:h8yUl+DbcvRvd09zlvr

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Extracted

Credentials

Protocol: ftp
Host:
ftp.antoniomayol.com
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Targets

- Target
  
  PIQ9876009000.scr
- Size
  
  1.0MB
- MD5
  
  46d85fc1602d0660d1c527fccd164fb2
- SHA1
  
  b786171e99925a9b5c0bc644d4bb22113b8f8309
- SHA256
  
  e5a3d44658351a18530e5de7e02afd94b5dab10a4724ccf6a9512296a263c896
- SHA512
  
  3d4a1fbeff0203119307fb3493fa48334f96c56abfd3a0014b33c39509e411337558512bbf6ea7bbdafece336895440d1590a6ad1616bc36ce370f1b89f55dcb
- SSDEEP
  
  24576:+9xsmWPOiTzQc+kFqrh8UWY0YvrRZ9r64UvPXy:+CmKIt8XTYvrZr6JPXy
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2