agenttesla | dab42d0de3c28c50091eddc85d2b05663972df8bdccc708724d7cbd2311636ee | Triage

Sharing

General

Target

dab42d0de3c28c50091eddc85d2b05663972df8bdccc708724d7cbd2311636ee.exe
Size

1.5MB
Sample

241009-qt4agazfld
MD5

eb59b9d0df184bce3d9e139b71cd1c67
SHA1

adaabdf114f5df14446446ae0e24b31fca833af8
SHA256

dab42d0de3c28c50091eddc85d2b05663972df8bdccc708724d7cbd2311636ee
SHA512

ea788f3f0c4862040cd4cfbe1696def3791b21a52e611d00dfa45af1d3a21194b1c25d1616daad69198e99beafd9cce9fa1be7d07a7192ea449f50136bdf5947
SSDEEP

24576:uRmJkcoQricOIQxiZY1iaCAxYmzr3wN2d4iM1jy4buVn86RRgCp:7JZoQrbTFZY1iaC/mPAkutzQFp

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  dab42d0de3c28c50091eddc85d2b05663972df8bdccc708724d7cbd2311636ee.exe
- Size
  
  1.5MB
- MD5
  
  eb59b9d0df184bce3d9e139b71cd1c67
- SHA1
  
  adaabdf114f5df14446446ae0e24b31fca833af8
- SHA256
  
  dab42d0de3c28c50091eddc85d2b05663972df8bdccc708724d7cbd2311636ee
- SHA512
  
  ea788f3f0c4862040cd4cfbe1696def3791b21a52e611d00dfa45af1d3a21194b1c25d1616daad69198e99beafd9cce9fa1be7d07a7192ea449f50136bdf5947
- SSDEEP
  
  24576:uRmJkcoQricOIQxiZY1iaCAxYmzr3wN2d4iM1jy4buVn86RRgCp:7JZoQrbTFZY1iaC/mPAkutzQFp
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan