agenttesla

General

Target

8e1391650a0be2289728f3dfdf1ba86902e00d8e0765373f079d937ae99f2f89
Size

14KB
Sample

241017-bp9t5axgkm
MD5

92ecdc2242c9fa3ec93351bc0240f376
SHA1

a87cbf4661899e377df318dc3544823b172ad706
SHA256

8e1391650a0be2289728f3dfdf1ba86902e00d8e0765373f079d937ae99f2f89
SHA512

3398ac31afcb71f045b2ad90b56b46c29515a87e029d8290200be89a283df324f87fb763d2b6845a950580c7e113ae84deca49c307b04ccabd159a070ce180a8
SSDEEP

192:dLmd4CdOuruUl1OgmEg5Rh7rMSTiuoXZ4caR/C3pQmkUOqiNESY8T1PHS:dyfzb1OTEg5Rh7rMMiXpAFCZeT1HS

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
marcellinus360
Email To:
[email protected]

Targets

- Target
  
  8e1391650a0be2289728f3dfdf1ba86902e00d8e0765373f079d937ae99f2f89
- Size
  
  14KB
- MD5
  
  92ecdc2242c9fa3ec93351bc0240f376
- SHA1
  
  a87cbf4661899e377df318dc3544823b172ad706
- SHA256
  
  8e1391650a0be2289728f3dfdf1ba86902e00d8e0765373f079d937ae99f2f89
- SHA512
  
  3398ac31afcb71f045b2ad90b56b46c29515a87e029d8290200be89a283df324f87fb763d2b6845a950580c7e113ae84deca49c307b04ccabd159a070ce180a8
- SSDEEP
  
  192:dLmd4CdOuruUl1OgmEg5Rh7rMSTiuoXZ4caR/C3pQmkUOqiNESY8T1PHS:dyfzb1OTEg5Rh7rMMiXpAFCZeT1HS
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2