agenttesla

General

Target

744677e893a1b8234fe8b378a9597f4a9d2a162ae403d6ad3407df7cd0e86eba
Size

514KB
Sample

241221-belpjsypcm
MD5

6d0d3e4f1b16869e65c72c2d5379bb72
SHA1

11eba83416c41c63b52bee8e31bb9328abb24e89
SHA256

744677e893a1b8234fe8b378a9597f4a9d2a162ae403d6ad3407df7cd0e86eba
SHA512

995bc0e2f5cec4f1f43db621130d349b08927fbd5156e62df08aed956dd13e55976a27037ee4c528c4609fca5a477f2d747aca4062ec8307a4a1546ec01b0dda
SSDEEP

12288:9V4exoMYWAcx+ph4+pJf5clCDkEEuJIvxPSAZV1zGl8RAZApjppW4P:0Sx+gm/clCYMJIvJXnUmjHPP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.stingatoareincendii.ro
Port:
21
Username:
[email protected]
Password:
3.*RYhlG)lkA

Targets

- Target
  
  Confirmación transferencia interbancaria.exe
- Size
  
  539KB
- MD5
  
  be37ea5702226bf6ed17a5031c2d75d0
- SHA1
  
  c398fd238eb4c706ea7aff5c24cc0eaf93bcf077
- SHA256
  
  7dd88bb379949c90207a5d476d7318ba98ccb6cb7853409c6d323febd28d318d
- SHA512
  
  dbccef3070c62d1fa2fad4f81e1a8cf8d8a86e3a3e4b81a7dffa928110f7d2f1dc426141c28a52be70a0beaaed1d9d8cfc0079294fc85b06089d0c5e584e8906
- SSDEEP
  
  12288:LquErHF6xC9D6DmR1J98w4oknqOOCyQfDp0ZOJovZNf9t7:Srl6kD68JmlotQfaZz7f7
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2