agenttesla | 05575771a33878dd35e54bfbecadc79b6780cbdd8dd4ab4738e255f8ac6b64a7 | Triage

Sharing

General

Target

28092024_0322_26092024_SITHIPHORN_Doc2709202400000.rar
Size

16KB
Sample

240928-dw5j4axarc
MD5

7e607a2d7a2d69326973c0ea3bdfb138
SHA1

401b4c78ec4b8ef5c99ab62e517540543d7df60c
SHA256

05575771a33878dd35e54bfbecadc79b6780cbdd8dd4ab4738e255f8ac6b64a7
SHA512

f21803cf2df4838f12072fd26ec97e53d9cee885fb0f9b771590e4a89fd30a6fc9f910ddd8b78e8c76712dc8c8868fe9157f68b4e7f438abc887bc5c91b5610c
SSDEEP

384:L22eETT+Jzx4Tn+AcDgxUJ0tz5Ij1O/zpI1wve1cOt20:kETT+Jzx8SDPUz5ZpI1wve1cOo0

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Targets

- Target
  
  SITHIPHORN_Doc2709202400000.exe
- Size
  
  369KB
- MD5
  
  ba71b8b432f3c3575bca530cb8993a15
- SHA1
  
  4253e361af1f8711b09f5031b70c5a16c551c384
- SHA256
  
  bfbda87afcd9cc4f6e39550149d7ebfcaebd2ee97e38d69842d93f7f12c2a05f
- SHA512
  
  5a92287dd3feb012d9a3b77372f5160d8e566203b2126dfb3aee3a64a0b8a2c274e542d3c84272240b25b4c0c9e25736ab0d6b303dda2fa7d26a23dfa85cf462
- SSDEEP
  
  384:jSYfj/Of4imYnyEVPTHWKtL2H0VuM35zlQEew+yTzSf4JM54iICSCr4H444uiiiw:jHjQ4KnyAWkaHRQMwdz+4H4447iiL1i
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan