agenttesla

General

Target

e62057f10b6090e111fd745be605e209952a45aeb07436aa354ad500e3dbf18e
Size

567KB
Sample

241117-bl5q1asjhm
MD5

15853351c81bf7af60cbd64123b562a6
SHA1

96911f47ad7c7670a855d2585ff98d6ee168c48d
SHA256

e62057f10b6090e111fd745be605e209952a45aeb07436aa354ad500e3dbf18e
SHA512

48f84847903e786b8a603a1f004c23e88f0a403ab63021b27602bdbacc4d69a16cec4c95f97eebc6c2d0cac2e3b9bea487e8ad9df74625b422a0892d42a0c6db
SSDEEP

12288:n4p/u/4SAYaTb7RHl1FwlVyUgV+t94veNgM3FJ+4u5gD6j9Ul/4NdRKm:n4p/0haTfRHl1FWVyUgM9lNvJ+4pV27

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.elquijotebanquetes.com
Port:
21
Username:
[email protected]
Password:
-GN,s*KH{VEhPmo)+f

Targets

- Target
  
  Envío de Orden de Compra No. 66534_867542345467897867868967.exe
- Size
  
  592KB
- MD5
  
  32dd4a91b91b50542a0d1888aa9d238a
- SHA1
  
  dca941669e584621320a502e7cf539029d29a7fe
- SHA256
  
  d62e60bf170f4aa1e0020bf9498aa7ea01b7a24398272019e45a1459f4db2301
- SHA512
  
  f743b0a61035037d5fa58380c4dd8248052b1285660550d2746c595bb141b8a0bb3460f140b3ac61295eab5be5568586480a3c254e9c2fcd0dd44ec0c8bd3a74
- SSDEEP
  
  12288:YsHzOUNUSB/o5LsI1uwajJ5yvv1l2TUxEAjfBBs7SOvNnuvIX4:riUmSB/o5d1ubcvuuIzux
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2