agenttesla

General

Target

4607df181c7ba5d22db44186f7c7b147394b0b1cd5e28d38d6aa2371e8f1dc61
Size

753KB
Sample

250118-bdv7layqbj
MD5

a25775d8a09644fdd5694feae6a4dde6
SHA1

3072306c0d9ab4aecf5c7bbb23f3f5f83cbb70cc
SHA256

4607df181c7ba5d22db44186f7c7b147394b0b1cd5e28d38d6aa2371e8f1dc61
SHA512

ef9418a26b2ecc7590dfb8864c7d5874a9b2804c215d33ba8878606f50bacda17500f266c6c8f7c72d96908f36747f505270279981916263ecb063111c2287fb
SSDEEP

12288:RHmV/54cNmO8sK1LOxrIFXDfDPYjXZV4GEJh/2IkauIJJWBxlemDcCjQNhr6yj61:RGVGcNeL1LA0VD09V4fGIIIPWBxzDhks

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.stingatoareincendii.ro
Port:
21
Username:
[email protected]
Password:
3.*RYhlG)lkA

Targets

- Target
  
  OC 44076345.exe
- Size
  
  834KB
- MD5
  
  be8f68c345d9f2f95d757df5bd331eaf
- SHA1
  
  f7818e339c05676f265ed085f57392875daebe13
- SHA256
  
  555c6eb8de554cac076806b73ce42e39f867a9801c6fcb944563d30cc1e049ed
- SHA512
  
  0c3b0c8d1110c7ae6f3df6a08fbfc38c263b00ef41c1121f76fdcf9ac525e7398fcc9911a2d117628277ac68bdf10040fa18f079178bc86764565253e65c8a80
- SSDEEP
  
  12288:46Wq4aaE6KwyF5L0Y2D1PqLrSKxsZJfUJt0Q2ikCj9g0UO899wt0V7U9eapvnMmG:OthEVaPqLrSKx530QZkVIYchpFXK7vuU
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2