agenttesla | 355878cfd65adca3a5ee759a484041f823bc9578099e5ef4180de198931592f8 | Triage

Sharing

General

Target

355878cfd65adca3a5ee759a484041f823bc9578099e5ef4180de198931592f8.exe
Size

1.1MB
Sample

241009-bskpeasekf
MD5

a437894833f1d29adfdff86cadefc0fb
SHA1

a6026520fb59515d7533ab33548f926f0d1e9a13
SHA256

355878cfd65adca3a5ee759a484041f823bc9578099e5ef4180de198931592f8
SHA512

d6012c6c7c7f776c0540df3b98f6e55f9039a6c99b57b3d5c71cc55ab3e514bae3318b1ecc4289a09363a74b8ddc88d8fcb6be0e5e8635d487b60072101567b3
SSDEEP

24576:WfmMv6Ckr7Mny5Q6J7IAH/iZpGY/fUAo9TZq:W3v+7/5Q6J7IAH/inDfUAojq

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
uy,o#mZj8$lY

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
uy,o#mZj8$lY

Targets

- Target
  
  355878cfd65adca3a5ee759a484041f823bc9578099e5ef4180de198931592f8.exe
- Size
  
  1.1MB
- MD5
  
  a437894833f1d29adfdff86cadefc0fb
- SHA1
  
  a6026520fb59515d7533ab33548f926f0d1e9a13
- SHA256
  
  355878cfd65adca3a5ee759a484041f823bc9578099e5ef4180de198931592f8
- SHA512
  
  d6012c6c7c7f776c0540df3b98f6e55f9039a6c99b57b3d5c71cc55ab3e514bae3318b1ecc4289a09363a74b8ddc88d8fcb6be0e5e8635d487b60072101567b3
- SSDEEP
  
  24576:WfmMv6Ckr7Mny5Q6J7IAH/iZpGY/fUAo9TZq:W3v+7/5Q6J7IAH/inDfUAojq
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan