agenttesla | d06eb6963064af04b5249b6e488fbd53cf97dd09a4d18144560488df9f473db7 | Triage

Sharing

General

Target

inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Size

814KB
Sample

241002-p2c8kswhnj
MD5

0ad77182f6aeae3adfa6ccc0aa964a5e
SHA1

fd2836072c56df6f9a9ec2dc7930f2bd1ad3773e
SHA256

d06eb6963064af04b5249b6e488fbd53cf97dd09a4d18144560488df9f473db7
SHA512

81bb614397ad1e71681f741325027a098a27b467b76bb23fc17be4c22c667de01f22fce8e136ede8784e9b178a7c1e6b862fa31cc48a28aeab1808bd44e1c32c
SSDEEP

24576:nqWVc+80IHhD5fhrZ3B7nnUeGZKqX7IM:FW+tIHhD5fhrZ3B7nnUDZP

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.alternatifplastik.com
Port:
21
Username:
[email protected]
Password:
Fineboy777@

Targets

- Target
  
  inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
- Size
  
  814KB
- MD5
  
  0ad77182f6aeae3adfa6ccc0aa964a5e
- SHA1
  
  fd2836072c56df6f9a9ec2dc7930f2bd1ad3773e
- SHA256
  
  d06eb6963064af04b5249b6e488fbd53cf97dd09a4d18144560488df9f473db7
- SHA512
  
  81bb614397ad1e71681f741325027a098a27b467b76bb23fc17be4c22c667de01f22fce8e136ede8784e9b178a7c1e6b862fa31cc48a28aeab1808bd44e1c32c
- SSDEEP
  
  24576:nqWVc+80IHhD5fhrZ3B7nnUeGZKqX7IM:FW+tIHhD5fhrZ3B7nnUDZP
Score

10^/10

discovery agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan