agenttesla

General

Target

6b1dbad706ccd33e97eb7899b5c1719cab5c1e28a6f497874f5c6088b67a435a
Size

610KB
Sample

241117-bhkxessjbk
MD5

7dd092c4b2ffaad28735413f948b3742
SHA1

eb7fff9c38de55d8b6a98228d8a0e7e8fef0d9ab
SHA256

6b1dbad706ccd33e97eb7899b5c1719cab5c1e28a6f497874f5c6088b67a435a
SHA512

c6fb51f47be24e76b50c4d3cefa89b6653dcc18243945850fbe171b06c337ef3e273f0f45b458ffee5260a1b13512779c9728227f4af266bb4b27890319be8fc
SSDEEP

12288:POv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi9pPTofZu/MmVmYUSdF+V:Pq5TfcdHj4fmbMllkYU08V

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.stingatoareincendii.ro
Port:
21
Username:
[email protected]
Password:
3.*RYhlG)lkA

Targets

- Target
  
  6b1dbad706ccd33e97eb7899b5c1719cab5c1e28a6f497874f5c6088b67a435a
- Size
  
  610KB
- MD5
  
  7dd092c4b2ffaad28735413f948b3742
- SHA1
  
  eb7fff9c38de55d8b6a98228d8a0e7e8fef0d9ab
- SHA256
  
  6b1dbad706ccd33e97eb7899b5c1719cab5c1e28a6f497874f5c6088b67a435a
- SHA512
  
  c6fb51f47be24e76b50c4d3cefa89b6653dcc18243945850fbe171b06c337ef3e273f0f45b458ffee5260a1b13512779c9728227f4af266bb4b27890319be8fc
- SSDEEP
  
  12288:POv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi9pPTofZu/MmVmYUSdF+V:Pq5TfcdHj4fmbMllkYU08V
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2