agenttesla | 0f3ce026b0869cef3ad4f8fbd685e6b841b18455b80bcf1b3844e5574e7ac240 | Triage

Sharing

General

Target

0f3ce026b0869cef3ad4f8fbd685e6b841b18455b80bcf1b3844e5574e7ac240.zip
Size

25KB
Sample

250121-cnn2ps1md1
MD5

a4ed0dd9d5420374f100741c3293fecd
SHA1

1de193f4a41c9ec80a013dd01d2d3a37fd03bbcb
SHA256

0f3ce026b0869cef3ad4f8fbd685e6b841b18455b80bcf1b3844e5574e7ac240
SHA512

b3f9cda3871fbd2c349dfafc6f3f608dcbde4c272712a6843b4f611393b0871e971f9b29d5e9069e9baf0126596d6875d79a05a83ffc600c7adc3b518884c854
SSDEEP

768:OYpIpxUQkXlv4nqSB9fIq0f0I3JSJbCIVa60vTqebi:jKp3q6Gf0I3JSJfH0O0i

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
manlikeyou88
Email To:
[email protected]

Targets

- Target
  
  PO-Tooling CT240230231 - CTA240714.com
- Size
  
  46KB
- MD5
  
  1f33b2b038c4d62ef89483a746f86012
- SHA1
  
  c54c6647703964e2dc01f11f44cdcb29a112be90
- SHA256
  
  a4eb8041e9e7013243bed5391a31c3bdd813bcc64f928a8778b80e7ca31778f9
- SHA512
  
  8dbd263e8d4e518f427f706d85867c21e5e146317fcb1a73e7191d03c8bff75654ece51dc2242aa43dc18bfb7387ed0330f12df7f45749e78dece3d510a9fa08
- SSDEEP
  
  768:mKT/nyl4QXU2+kCYU1qLn2uDf6s6i5MXAjWHRc9EB+Yhd9eYBcriEsO:DT/yl472ls15u6fxc9E9haYiCO
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan