agenttesla | 71df192a106712e4f565eceac1043decfb1e190a245efbb47dc8e6b5e6af71f6 | Triage

Sharing

General

Target

71df192a106712e4f565eceac1043decfb1e190a245efbb47dc8e6b5e6af71f6
Size

766KB
Sample

241007-q1h8waxhqm
MD5

4205b5f255526c13a702fd1da49fa7fe
SHA1

9935367016d7b4bad404a171dc7e7375a2275284
SHA256

71df192a106712e4f565eceac1043decfb1e190a245efbb47dc8e6b5e6af71f6
SHA512

cc7a551e94b6b398a92fafa2b5ef6f7ecbe400007b0a074a2b280d171cd6cc27ff9666472693ea03c235926d4df048744ff15a351321a0568a539054a9105345
SSDEEP

12288:LhiRx+9tkp5RE1Of9A7whWemYLFfdBjfkEZ3WBxFnWna1F0DkxDceO/womeP3ODw:wYtaRE1WAkkCfd1hABxFWaIO4eneF

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.starmech.net
Port:
587
Username:
[email protected]
Password:
nics123
Email To:
[email protected]

Targets

- Target
  
  shipping.exe
- Size
  
  1.1MB
- MD5
  
  30ec04c01f8fc2f669a92285422b8ac7
- SHA1
  
  65ea24d2c0bf10575216e4e89e77d304c9d900d7
- SHA256
  
  cb8e8d185adfffe272bafb00ef1000724beac1e478fba3e50682ac0c2300d0bc
- SHA512
  
  ca647c33c90417ed3d0d7a7c72bcec075ec28fd89462c140e312bd72c196f0a8c1db597c3db9518bef49b7291e7e35d03058c594ec683d78bf4cfa592195414a
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLPnvM+00kNYUozd15i:f3v+7/5QLvvM+00TUop1c
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan