agenttesla

General

Target

quote9601358.7Z
Size

572KB
Sample

241118-rhnajsxhra
MD5

4edff6f95d42d0c62cebc9ea87c13e0a
SHA1

b006d857fefaeaf094eef84bd76e829cc734f8ea
SHA256

cbea9c46a0bb6d10fca4b532b5dfcb901fbdbee2647815a15ba9cb4194b07609
SHA512

a2c6d6d6ac050bdb4e9c30a1383eb39fe648e8eab09e3f1bc4def751bf09d0e5a0d843a4171ce30bc9493ccc0fc3422d393630a81acf3ae7fa06b36edd6e5f9f
SSDEEP

12288:74z+DKDPd5eazEs60yVm2cq33CGZe/ggBFU/XrFsg2NdDHXeCd+mZ:74z97nbABPcq336/xB+/7FsgeDHOnmZ

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.stingatoareincendii.ro
Port:
21
Username:
[email protected]
Password:
3.*RYhlG)lkA

Targets

- Target
  
  quote 96013587.exe
- Size
  
  647KB
- MD5
  
  c660656c29bc00c64f5f93cdf371e6c1
- SHA1
  
  2121adcebd5cf58897b6a2775a61677494a25ae4
- SHA256
  
  fd982e9e8c724d7da7aadca4efaffb5ed6e8c5d368cf4e3e4c539b5856c36707
- SHA512
  
  3712bb256657877678bacdbaf30b139ef3ebb7b9baf7e64e3ca0ae447776492bc2c8f02c96abe2359f47094fe6b1afa4baf4c060f0d2074017254aab39b4b990
- SSDEEP
  
  12288:tOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiGtuyF5DgOmxbnghy5SLK:tq5TfcdHj4fmbp95nmxm8+K
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2