agenttesla | 25ba43cd4821000f870441800604ef8809dab319fc0faae17a2f77614c980fe8 | Triage

Sharing

General

Target

25ba43cd4821000f870441800604ef8809dab319fc0faae17a2f77614c980fe8.rar
Size

21KB
Sample

241010-bprzbayfmp
MD5

25f8ab7a3cec1199b373e05f25474318
SHA1

c5d9c8f7082b037ba4931484718c99a72bc4f5b9
SHA256

25ba43cd4821000f870441800604ef8809dab319fc0faae17a2f77614c980fe8
SHA512

011cbf676524924b38a85491394e129a9523b3a20dc40802b05916055bcac773708addeb46c8c86534bf6a44d1c02388cf65cb30889475d68e6529f2a6c13d0c
SSDEEP

384:dz4u7Ow7U3Y09WZyFKuacpBSzqhn4G1lgsjhkguFJLME28MZ06WJm3Jnex7qC:J4uV7U3Y0ClcpBaoR1ZjhkFpL28MZ06K

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.alternatifplastik.com
Port:
21
Username:
[email protected]
Password:
Fineboy777@

Targets

- Target
  
  Request for Quotation-8479203739-002-MMA Offshore Asia Pte. Ltd.exe
- Size
  
  39KB
- MD5
  
  7edaa96c807197b45ffb4f442ab3bfaa
- SHA1
  
  a87db0d82f05e80b4511667c01305993d9265806
- SHA256
  
  359c1e634d4b0d664443dca2ef11d6f5d68dcd381d56845e9212766b8b67e64f
- SHA512
  
  5d8c898dbd2cea8cc0f76ae315ab6ad0e6b466ec78ddc9f3f5d4987329a6dcc924acf0c9f431a4093f64a99e7cc4f1038e4e6233330a27e4c53de8dd91e45fe4
- SSDEEP
  
  768:L4lCZTEnqqVW1ZwqBMHlfXfLHTwfxlgqkCWIU:E1qqV8wqevfPWuCG
Score

10^/10

discovery agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan