agenttesla

General

Target

702bfa8f5e655b8e697c0da0fe6ef8d381ddc9ee9f8fdb75b4fdddf19c30758a
Size

777KB
Sample

240926-eawwhayepb
MD5

30a08022859dbb5fe74bf169c5a1db1c
SHA1

036e2e931c1154d00df36b6f697af3519bcd2dd2
SHA256

702bfa8f5e655b8e697c0da0fe6ef8d381ddc9ee9f8fdb75b4fdddf19c30758a
SHA512

cee317178a8d34a25c3ca89f033fd4582459ffb880b820d3f19bfe52ae19cba2a9f9ef8d1e88e3b90463def2d4d15c5cc48c5fdc29ea52d2239d51878af1e684
SSDEEP

24576:cEQyl8zfv2GjJmnE1VVxuOHH/g2HIDN5GVdA/dXs0ghv:cCfqJmEHVxVHI2Hcbwyhv4

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Targets

- Target
  
  UAE7890-0987654.cmd
- Size
  
  792KB
- MD5
  
  98078b4fc9598e0abf14580358bdb595
- SHA1
  
  7569139aa8940c37ee30425763a9225042c9bc4a
- SHA256
  
  be355266f38c5cddc82ad263354ea1de12ff6a9f8c008c412e22d94a30db6a84
- SHA512
  
  2591c7169791a7c8c875355c92add12eaca36509707404dd0dde22cbe752e96637384cf59b95b7df985abb86f8d0a727dc74bc18b69659c8ea7e1bb8846c7c8b
- SSDEEP
  
  24576:tthEVaPqLUgNxuELZ/u23IDHtoVJKzrJs02hb:VEVUc5NxHLA23cNqmFvS
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2