agenttesla | 5299286271c1c282edf70bd8bd6d640cfd4925f34b7d1c803bf1c1b15077144d | Triage

Sharing

General

Target

Facturas de pago 003839,72011,030184.bat.exe
Size

77.0MB
Sample

240919-pnet9ayarh
MD5

524a0138337a0772a674c026c6b0481a
SHA1

0dd8536f84dca74655e48a1f621ddcdb00a875df
SHA256

5299286271c1c282edf70bd8bd6d640cfd4925f34b7d1c803bf1c1b15077144d
SHA512

2e8863918ef51107ab59be77a8e4869593fe06138e823af8324ae4ed99fd49295df9de27b0dffcfa979ec5c24be8a359c070c87fbc44213dba4fc1be8c011f7d
SSDEEP

24576:44lavt0LkLL9IMixoEgea0rDGMFTHC1q9MmCS:Pkwkn9IMHea07FHSaPCS

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a
Email To:
[email protected]

Targets

- Target
  
  Facturas de pago 003839,72011,030184.bat.exe
- Size
  
  77.0MB
- MD5
  
  524a0138337a0772a674c026c6b0481a
- SHA1
  
  0dd8536f84dca74655e48a1f621ddcdb00a875df
- SHA256
  
  5299286271c1c282edf70bd8bd6d640cfd4925f34b7d1c803bf1c1b15077144d
- SHA512
  
  2e8863918ef51107ab59be77a8e4869593fe06138e823af8324ae4ed99fd49295df9de27b0dffcfa979ec5c24be8a359c070c87fbc44213dba4fc1be8c011f7d
- SSDEEP
  
  24576:44lavt0LkLL9IMixoEgea0rDGMFTHC1q9MmCS:Pkwkn9IMHea07FHSaPCS
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan