agenttesla | bf4bfd156f338dbf4cfb77cd12c79437cfa4288da1799efc192fc91d48d5b835 | Triage

Sharing

General

Target

RFQ678903_-INQUIRY_THANHPHUON_INDUSTRIA_TRADING.7z
Size

1007KB
Sample

241014-mqqnesteja
MD5

c4735f8ba1c0e5e3f3c81e33d1fa459d
SHA1

0eeb6ef3c18702b31d5e06359f6ef93122009580
SHA256

bf4bfd156f338dbf4cfb77cd12c79437cfa4288da1799efc192fc91d48d5b835
SHA512

5ca1bc25485098c41866290dee4ac8a66df863ced0419708e7d61160039f360fef6d134102bfb0f655d46ef76cc9dea8a93cab0b125d6afd0d3575ffe1ed3b0d
SSDEEP

24576:G2bM6frR8jk5o4xkBF9ZjaWxWULiN5T0sQmbKaY0UratT:GofrR+k5bkL4Z5YsQmbHPV

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.zoho.eu
Port:
587
Username:
[email protected]
Password:
office12#

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.zoho.eu
Port:
587
Username:
[email protected]
Password:
office12#
Email To:
[email protected]

Targets

- Target
  
  RFQ678903_-INQUIRY_THANH PHUON_ INDUSTRIA_ TRADING.exe
- Size
  
  1.2MB
- MD5
  
  38599452de2095f605b692a8aba0b457
- SHA1
  
  21f02b940d3e416a57e2eef4844fc91159f85651
- SHA256
  
  17fa46d3951bb6480a8a807e413aa93bb8d7a235b40f4bade542e72a32acf6ca
- SHA512
  
  ef1c9ce4c3da0cb5064951386576d2e8d7d9cb31e7dae9972ac3df89282a7c7b4bcdf4e9a8238df85cd50eb6372a23486fac256339f10d1cbd9850da9083232d
- SSDEEP
  
  24576:yq6zrF8bk5g4xYBdDZj6wxWqLeN/xoaY/scfXCzF:azrF4k5zY5Eh/x1YjfXCJ
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan