agenttesla

General

Target

98b6476344625f6f4510212eaa5e7b73343c136775e17c12ebebb0fc1da55427.exe
Size

550KB
Sample

250111-e71wqatqfs
MD5

692089076deaff03da7f7c4977b68ef7
SHA1

fcb8330a1b16a57a8d81c1b0ee584781b6c8e4d5
SHA256

98b6476344625f6f4510212eaa5e7b73343c136775e17c12ebebb0fc1da55427
SHA512

b746fabefab0a6e5cb2fe2c8eac9b540432a5b2bc6b3a90c894f3517d05195ff62c6838fbd9b8019bd0f717c284f23b2e82cdd30e1312f06e26602162d7d1e5e
SSDEEP

12288:oquErHF6xC9D6DmR1J98w4oknqOOCyQfqdXvlK9inAp61HOfu4:prl6kD68JmlotQfwo9y1ud

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.alltoursegypt.com
Port:
587
Username:
[email protected]
Password:
OPldome23#12klein

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.alltoursegypt.com
Port:
587
Username:
[email protected]
Password:
OPldome23#12klein
Email To:
[email protected]

Targets

- Target
  
  98b6476344625f6f4510212eaa5e7b73343c136775e17c12ebebb0fc1da55427.exe
- Size
  
  550KB
- MD5
  
  692089076deaff03da7f7c4977b68ef7
- SHA1
  
  fcb8330a1b16a57a8d81c1b0ee584781b6c8e4d5
- SHA256
  
  98b6476344625f6f4510212eaa5e7b73343c136775e17c12ebebb0fc1da55427
- SHA512
  
  b746fabefab0a6e5cb2fe2c8eac9b540432a5b2bc6b3a90c894f3517d05195ff62c6838fbd9b8019bd0f717c284f23b2e82cdd30e1312f06e26602162d7d1e5e
- SSDEEP
  
  12288:oquErHF6xC9D6DmR1J98w4oknqOOCyQfqdXvlK9inAp61HOfu4:prl6kD68JmlotQfwo9y1ud
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Agenttesla family

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2