agenttesla | 8a81c3cc487383e9f4373e5a89a0ea1a8f376dab654d5f476590a3991a832be1 | Triage

Sharing

General

Target

8a81c3cc487383e9f4373e5a89a0ea1a8f376dab654d5f476590a3991a832be1.gz
Size

531KB
Sample

250121-dwkvpatmej
MD5

7314ec0fcc64f0c516e503599587604d
SHA1

515ef69cd9d0b15c6eb057893d9446c320dadaca
SHA256

8a81c3cc487383e9f4373e5a89a0ea1a8f376dab654d5f476590a3991a832be1
SHA512

637fcf2af10f1eadf0c50c59dc1d7b4b26eb44311acf0f343df2dc3888ff6f24d02fd4ab55b13151f31f7f81f9e55405ad5f4bd4f2ef634fa6c97bd2617a25dd
SSDEEP

12288:qJfA80L8oMzeTbJsZW4vQgw2bHT3bL35hbWraBdDdLb8G:oIXIoGalkYg73bL3ZPJ38G

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.concaribe.com
Port:
21
Username:
[email protected]
Password:
ro}UWgz#!38E

Targets

- Target
  
  Documenti di spedizione.exe
- Size
  
  617KB
- MD5
  
  79cb40033e328f61fe68bd76dd67a7b3
- SHA1
  
  a68854ec2481fc2f874e2180dabb155e65c6fbd4
- SHA256
  
  255ddfdf1409d89110925cfa93ba323d1a68b6c0916764169eeea521867816a6
- SHA512
  
  7ef13f9f7e75c865a7c8140b9c615687e04cc1e46076de75a963952dff2d000576481854dce0e98cde8db9ee9c12f43cd8def9634fc7b00b09a0b95b6ca6e3cb
- SSDEEP
  
  12288:MDG0VKZA6BbbHyqrSXA8xvJMUzPvRQIBD7f/KYC+c8cIti62JB8PoZSBm:QKeybHyYSh1CefD7nxFTcIM62H87Bm
Score

10^/10

discovery execution agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

agenttesladiscoveryexecutionkeyloggerspywarestealertrojan