agenttesla

General

Target

453f3f89b2d12737cb46db2e6be35e178375deb75fc03aeadddef84f0f74283a
Size

797KB
Sample

241017-jsdj4aydpb
MD5

c3a78f4d1cc59a65ce67e5533cd083aa
SHA1

b1388518690a5de7524e89744a1ee723d91fbac5
SHA256

453f3f89b2d12737cb46db2e6be35e178375deb75fc03aeadddef84f0f74283a
SHA512

0eb0ec0d788e25c398e4386f3f9b42cf5b7ca7d2e658097d91e67e4a270456ca44ff3a996fe80bc05929017fb4fb3b2e644f596c718b81c6de4d2f9ac7680d54
SSDEEP

12288:U5fbSAuPjxMMNnWWpFkSP+mQLvxGLbnsqmrqYMBNaGyxXScN+XlIataSmC79lcMc:UBbK9XvkSSYaTSWfksUz1mTSaD

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Targets

- Target
  
  HG98765456789H.bat
- Size
  
  1.1MB
- MD5
  
  0f8c8f3f750b0b4a18edab0543e68aa4
- SHA1
  
  3ddacb0211cc68c45243a897c01f8f422c5194ac
- SHA256
  
  ade3a15703a901c6df8b389b0fd93901e8424d3e541a897d365c60b1d032fdb1
- SHA512
  
  d983ba6b826b9b00647b42736dd92147e3e973df88eb6bedd09412388baad62618608ed930ccde29e6a41acf126bcf570202feb1fcf67ab56d2d46425f1d989c
- SSDEEP
  
  12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QL32BqgahNaGKRXCcNuvlGU/aSsC7N9E:ffmMv6Ckr7Mny5QLGvW4P0s0H1gZS6T
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2