agenttesla

General

Target

21012025_0004_20012025_Orden 548850-30-AG24.GZ
Size

893KB
Sample

250121-acww3awmgz
MD5

f6a49ccbba5b8cd8bfb13f9bfa904ae7
SHA1

9664e28d9ebb6e7cbbb1f6f7e7bc39457286b908
SHA256

32d8241a694c79427c2c96a8b292081b07186d322b9a18073197733c29c880e8
SHA512

39d10b8b418fc064faf460ca6a0e3d94f8a0b53b6fc079a055be57bbc78d9487a98b865ae185095a6fe7e4fc9cfc37be130afd0dbc03c1ab6ac6f6ca05dedc4f
SSDEEP

24576:3rkVwZTu5Lw3sUpVYHkmQDKRfglWzgZLAOolgmveJXgm:3rkVAYxEmQD0gxZL+c3

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.stingatoareincendii.ro
Port:
21
Username:
[email protected]
Password:
3.*RYhlG)lkA

Targets

- Target
  
  Orden 548850-30-AG24.exe
- Size
  
  983KB
- MD5
  
  a79b9aaaa383bfde29d24a1f4e139c0d
- SHA1
  
  1cc0fb4303de74ad0561053f274eaee0819805da
- SHA256
  
  33f6b0c267f7fbbe29ef7999ef91a518f06411e6270efcef44623c2e8c3ba66e
- SHA512
  
  b268d32574fb05cac2b7b4c6c648c8455d2c13a4d025f1aeecbcffceca50f14581960b1a87aec905cc5e316d69ea08073363f9ad7f83c66b67bba9f8538c2423
- SSDEEP
  
  24576:Iq5TfcdHj4fmbY6Z9qwIWVyaad8a6VQC+eHh3M/Bv:IUTsamc6Z9oRya6VQC+oh3M/B
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2