agenttesla

General

Target

73b8a2fd3dd6b8966abda445e9d322dea069df2a357d9dbd81f683e4c4065529
Size

788KB
Sample

240924-tjfcfascjr
MD5

f1141dc611fae8a5a6c42fc3f6d80a1a
SHA1

751178098a65c96a0dd1df0187d7bbf156231ffe
SHA256

73b8a2fd3dd6b8966abda445e9d322dea069df2a357d9dbd81f683e4c4065529
SHA512

e46a32882981d229aba37c38d51aca591374decec5069abfb4adc14f25348580b34681048c577025bbdbeba2cca2bb22d22e8bdf2d2cc56884d43864aa3fb8a2
SSDEEP

24576:fEQyl8zfv2GjJmnE6QsxSc3zLYZPUIe8DBo9dpn:fCfqJmEBIS8zLYZPzt0j

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Targets

- Target
  
  POYTR56789900.cmd
- Size
  
  802KB
- MD5
  
  2d0ad7779ec8291f001e3706a427b8ad
- SHA1
  
  904e520fbaa11abcd2906b68dfb85ecdb0069e55
- SHA256
  
  b3c8caa00c7ffb39c1602051d1f48105e223ee1da817e9b37bfea0f35e629b1b
- SHA512
  
  ac4c30e36944ea676ff4543c74f78f99b394d421933437a5202bd084875cc1b180226daf1df8f8f6c08b7c67f3c12bbb4053f6429a8337b1ea825dda32bef80a
- SSDEEP
  
  12288:v6Wq4aaE6KwyF5L0Y2D1PqLmHRc3JalaLLW+ITJ3UiEGE3Gt3FoppG/i4BoPLppz:tthEVaPqL2c3rLSTJuWcgpBoP9pz
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2