agenttesla | f11112b253e141587881a55fe11cb6de669b7a9988fcd1b6b70c9caffc302e07 | Triage

Sharing

General

Target

f11112b253e141587881a55fe11cb6de669b7a9988fcd1b6b70c9caffc302e07
Size

593KB
Sample

241211-bgyrwsxrfv
MD5

22f0e30734f6f9b47f01e8a4c0b5c3b2
SHA1

c165ee5537f8a0f40fdb28020caf45d896195224
SHA256

f11112b253e141587881a55fe11cb6de669b7a9988fcd1b6b70c9caffc302e07
SHA512

b7da4110b918da2f8986707e169cf05ead4523b41b7c6d3bb999ca78d9ce9db0784d510b866da80c37dd93e2fba87588d2a8e8b7d92786a85bbb34472a2c19a1
SSDEEP

12288:POykmX/JQYZN3EgyhqkR/1PUhyV21xEkFqVcsQaqAqn26jZsU:2NAxQOlfm918hyVIxEaGcsQRAA26t1

Score

10^/10

agenttesla discovery evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
nXe0M~WkW&nJ

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
nXe0M~WkW&nJ

Targets

- Target
  
  f11112b253e141587881a55fe11cb6de669b7a9988fcd1b6b70c9caffc302e07
- Size
  
  593KB
- MD5
  
  22f0e30734f6f9b47f01e8a4c0b5c3b2
- SHA1
  
  c165ee5537f8a0f40fdb28020caf45d896195224
- SHA256
  
  f11112b253e141587881a55fe11cb6de669b7a9988fcd1b6b70c9caffc302e07
- SHA512
  
  b7da4110b918da2f8986707e169cf05ead4523b41b7c6d3bb999ca78d9ce9db0784d510b866da80c37dd93e2fba87588d2a8e8b7d92786a85bbb34472a2c19a1
- SSDEEP
  
  12288:POykmX/JQYZN3EgyhqkR/1PUhyV21xEkFqVcsQaqAqn26jZsU:2NAxQOlfm918hyVIxEaGcsQRAA26t1
Score

10^/10

agenttesla discovery evasion execution keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan