agenttesla

General

Target

19092024_0956_18092024_P0 n.° 1037596.uue
Size

899KB
Sample

240919-lytvdasdqf
MD5

79c3e1ecdeee91344e5a62114f329133
SHA1

05a51ca21b24eecb417db8c66a6c41d5d9d826df
SHA256

54ad506f3efd22bd7d992919dd3257deaf720d6997169098bcbdce7b9f21c3ba
SHA512

e90d338e43f91ee51d96fc9670c87e21ebbc3883e1ea05df4f8bb980a9e1ea9ba10737bcbe225fd31a9b0e4eaf756bb404919cafe32ba799f925994f1a121c45
SSDEEP

24576:F/p7/IHtg5uvSJX72KZSGYmFaR7rKHxSuo4r:lpUHSHZKZGSR7rKRw4r

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.gizemetiket.com.tr
Port:
21
Username:
pgizemM6
Password:
giz95Ffg

Targets

- Target
  
  P0 n.° 1037596.exe
- Size
  
  1.4MB
- MD5
  
  779916ce1a42f01bfbd61d9a8590c986
- SHA1
  
  1c96e7bc16c39d4d021526accda62dc356cd2425
- SHA256
  
  d5ae03977dc29b4ed4736c3f045bb47a670255d47dd189a58b90485ae23417b8
- SHA512
  
  f1b084835e3145de0651af493cc2c5ce8fe35bf594193001adf619155221c9101da84021f672935c382b8ad66347648e33ba7e04931c4fd43b6fc07083bfdfc9
- SSDEEP
  
  24576:pCdxte/80jYLT3U1jfsWaRvFrVIDbJtWF1WeiWr6dMu6Q:Yw80cTsjkWaRTIPO7ziA66u
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2