agenttesla

General

Target

fc6a34cbb17a3d86bf53bd04fa8cfe9d77025b0411a81d72f34bd35372ba44f1
Size

511KB
Sample

250121-bpjmyaypdy
MD5

2fe2d26d4fd6251c4248eced066a3d1f
SHA1

0a578036edb493e6cbef3ddcbb265663b61e83be
SHA256

fc6a34cbb17a3d86bf53bd04fa8cfe9d77025b0411a81d72f34bd35372ba44f1
SHA512

1539f2dcb74f051f104e80666a61c8a307d1ff6344d70d2c11a56a975b41323505ec67d57a543ea7300aa06a3de509881cd6e00c7524360615581dcd7cd44b68
SSDEEP

12288:a7f1TFE4g7uMZsrV7asxHk0vWjKTruODXR/OBa3G1loq+QXXs:G9TFa7uZlfxHk0ti6EBa3G1loq7Xc

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.solucionesmexico.mx
Port:
21
Username:
[email protected]
Password:
dGG^ZYIxX5!B

Targets

- Target
  
  Quotation Order #3344#. Inquiry for the Quotation.exe
- Size
  
  537KB
- MD5
  
  e9b2b9f88a84f5dbb4b9a846d003a628
- SHA1
  
  d27e07c291c15ec3178b8d743dc76dbbf8d15380
- SHA256
  
  991b777e3fac0e7150a7b0b9344aee001911ba43685a7d1f9b11d56e951c3732
- SHA512
  
  c7316e37c50824251068b48d2900442ef5a1e4cb4023aad5320c3d996deb8fd1e9a8f43b82a5f59e10d98d9c56022c00f61cc7e73540874d9e898043ebcde3e3
- SSDEEP
  
  12288:6ozGdX0M4ornOmZIzfMwHHQmRROXKWOE1VXJsJEWg:64GHnhIzOaWFVPx
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2