agenttesla

General

Target

PO I2241605CA_.pdf.lzh.rar
Size

493KB
Sample

240930-mchqnathlc
MD5

78358a26d53932f65db36298e025ccee
SHA1

cce3b1ee6ca1a3340cc815fadc748bdfce8ef842
SHA256

13055826d323bea03461e141344f2d103741df8631642874130a9166ac9b0e7d
SHA512

9b965880be69076e6dea27bde7da243fcfcb3288de590566942316688556f90d7de03818d5bdeaa3ec8dc92c6a0580f0411681138729dabae0aec5021bca4f14
SSDEEP

12288:PvpCO7L4TRhzUQF6AiEJnn0wvIYtlJn9ihqdCy:n4O7MLUQNDTIub9ihny

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.gizemetiket.com.tr
Port:
21
Username:
pgizemM6
Password:
giz95Ffg

Targets

- Target
  
  PO I2241605CA_.pdf.exe
- Size
  
  100.0MB
- MD5
  
  a31b2ef5459d12ca2157dab791a56583
- SHA1
  
  10292d68271c4a3a149cd6f5f92f70d6bbedc1ef
- SHA256
  
  69a30c0c99881db975640d6124c91429fdf2b2dc494d47fe3d72cdb1b85d7c7a
- SHA512
  
  38196063f90973a1ee8347b6fab1c56f85a8c70eeca3fda16305a7e482a13a65829b09fa23d3efca3fb55f95e3d66384399eb89a3fa127b160390ad6726367ff
- SSDEEP
  
  12288:V9BvctM85t35JPNJj2WzoRLQYRYzmYugnBsicir5Wdc75c:VD0tM85tbNJjldeYiYuUBsiciB75c
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2