agenttesla | 2e890fe607e397957dcc1b6ca9ba5a7d7516b0504f171ebf4b4f0ce9fc6e841a | Triage

Sharing

General

Target

2e890fe607e397957dcc1b6ca9ba5a7d7516b0504f171ebf4b4f0ce9fc6e841a
Size

724KB
Sample

241007-ccd3csydln
MD5

686193bfbeefb47a069a9a7822beefcb
SHA1

1d07d649187d2c9bab73824d29de2f227752da6a
SHA256

2e890fe607e397957dcc1b6ca9ba5a7d7516b0504f171ebf4b4f0ce9fc6e841a
SHA512

5c5094119c39f2007dbcd50d1246364eae7ba90b49a721950f1a7681fda4ebd578b9b654116e4566c66b85d6fad13f97a0e73ce2c21b4be465192703b34f7025
SSDEEP

12288:bhiRx+9tkp5RE1Of9A7whWemYLXPH0eZd6Hbhwfar0PCWgvJs2r6Xi0iao/sD6LF:gYtaRE1WAkkKPUef4GaGWh/wiMo/C5mR

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.starmech.net
Port:
587
Username:
[email protected]
Password:
nics123
Email To:
[email protected]

Targets

- Target
  
  New order.exe
- Size
  
  1.0MB
- MD5
  
  cc0e7f78f732294205367b63c08b112f
- SHA1
  
  2994128f0369ad6fb19c2b70b10d1150126718f1
- SHA256
  
  1ddb5066864496c4fdb477252d09eee2f3304d5801c93bc9a72acb22eb78523b
- SHA512
  
  1f2f2a93354b467eada7729c10a7e40b54073d484dd18ee64f04a88d6bdb9672cbbb6e998b671c54c3dceb306c6ff01ce3ca74681f7dadc280e6ce00f6fe88d7
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLgssNh4LygQJgrmCeYdc00c:f3v+7/5QLgL7lJgr5N9
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2