agenttesla | 9e985056af221982b4515fed1fdac3693159c46073a50b059038e2f3326c039b | Triage

Sharing

General

Target

9e985056af221982b4515fed1fdac3693159c46073a50b059038e2f3326c039b
Size

372KB
Sample

241122-bpcjmaxmck
MD5

5c779d720182e8cfed31115908d831d9
SHA1

2457ae546060e3e0fcbffdd8853b6bca23755eee
SHA256

9e985056af221982b4515fed1fdac3693159c46073a50b059038e2f3326c039b
SHA512

9e659d48dfc6eeaf3e0b43854ba2f477835bd2189bfb0dfde2d63e2f6a60fe8154a676fb14c2f8bf047497976d2a2f3a6a26e23732f629593fe66659664a5b43
SSDEEP

6144:Z/mOLC2Eb2PBknrtX1+uWBxe2k2F7/ZgkRpqwNPU7bTXUYNF4d7B9yOhNSgdIZ:Z/mwC2xmrtX1+uW62kU/rR4uPMXUYNaQ

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.concaribe.com
Port:
21
Username:
[email protected]
Password:
ro}UWgz#!38E

Extracted

Credentials

Protocol: ftp
Host:
ftp.concaribe.com
Port:
21
Username:
[email protected]
Password:
ro}UWgz#!38E

Targets

- Target
  
  Shipping documents 0200394940040590000000.exe
- Size
  
  597KB
- MD5
  
  8f435a0c4a81015074a8f19f0e9b2644
- SHA1
  
  b63079850d3cec7235d57da98f909085b7c5037d
- SHA256
  
  2d126c5bf59b96dee9a4ba8208aa45e99fcdb08b32790186d6822af01fa4090a
- SHA512
  
  c065f64a98725af1c713eefe005efa956a3e8eccb1fd8d2526b5f5c88b9eee80fa11c795ab4ce6457477a5e8dd8ac1040c6d2447afa318d0a235c07acba3cad5
- SSDEEP
  
  12288:beoG69q6uRk70Ix/BHxsD52ralLNFUjt:a5EpRsD52ral
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan