agenttesla | 809bd7e493349e3b849c869f35263f08f9ab62c3adb3f0d5bc99734c8f394c67 | Triage

Sharing

General

Target

809bd7e493349e3b849c869f35263f08f9ab62c3adb3f0d5bc99734c8f394c67.uue
Size

3KB
Sample

240928-byckzszdrn
MD5

e6c4f7d2f8fc30ed157369622af77911
SHA1

3382b4e8ea9967f17518dceea2b0cfb2860e56c6
SHA256

809bd7e493349e3b849c869f35263f08f9ab62c3adb3f0d5bc99734c8f394c67
SHA512

a6f7f8136725c52e20576a85f77f7d3a108cb19f02ca2e140ae0a2ac9a0724af5d91c90ad9851f635f14e921a9f2c9144e2d2c4ba0e5637bf5a4f657742100f7

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.alternatifplastik.com
Port:
21
Username:
[email protected]
Password:
Fineboy777@

Targets

- Target
  
  PURCHASE ORDER ADDISON-6378397379UUE.exe
- Size
  
  7KB
- MD5
  
  b32b692f2f1d152b25b021c971907d33
- SHA1
  
  362fd25700760c221f82c1a932bdeb96bf0c7030
- SHA256
  
  f332602d5b75b204e97c0722e078a4f87567981731e4b13eb45b521607eedff2
- SHA512
  
  ee0112be727832a249b1cc8130ad69ba438708915db90a2461ef906e710452dcc876d0ccbfa60a89fcea26a84dcdf09d4440d364efbbd96221b63eb8c9f009e3
- SSDEEP
  
  96:5fu/dQ+az6jFI+pbuIvQCwp5QH0jOr0u0GFi1GIfyzZeczNt:5ydIz6C+pbuIvQL5u0jpuVFi1GIKzcm
Score

10^/10

discovery agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan