agenttesla

General

Target

908ee14e68d034c901aba845ca4b745d15dc622a28c231c09154036c62ba02dd
Size

773KB
Sample

250118-bd2dlsyqbm
MD5

191258197ee5ffe7d2ec557abc561777
SHA1

6e6871eb8f4c36163db85d49cd83fbe16f4c208f
SHA256

908ee14e68d034c901aba845ca4b745d15dc622a28c231c09154036c62ba02dd
SHA512

2e966dcf8f1a0b4009173dd2ef2e6fdd93e026e91b102ede5e95fd29afe16e52d341158cd63a718776b846d68ff67901e4e3bdb549f7fc08a88eb888c8259ff4
SSDEEP

12288:hHmV/54cNmO8sK1LOxBn0mtQl8TCHdrCrDCcz/dQ7PimPKIUt6sudH:hGVGcNeL1LAWmtx+N+zSJrUIsw

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.stingatoareincendii.ro
Port:
21
Username:
[email protected]
Password:
3.*RYhlG)lkA

Targets

- Target
  
  OC 44076345.exe
- Size
  
  854KB
- MD5
  
  5b68db27ab57cfa450f960280e792edf
- SHA1
  
  4c2ca8ba152eb0ed559a7805308cc627d8b99249
- SHA256
  
  1d5cb30274b49c42891b071d9ac806b4b24ab8a5b940decb7534ff4bde52ea5c
- SHA512
  
  bc3c526bf61f942582d285d49f61bf37a6bc444c086d45dbf745b0830ab945324e13e81552dc2201cfeb82b54bb457a848e10a4579580e3a598cdde26a1b5c43
- SSDEEP
  
  24576:OthEVaPqLrINApV8RhDd7gzSedjwoVvakS7:WEVUcJpeRhDdEWezvaj
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2