agenttesla

General

Target

Doc_LOI.zipx.zip
Size

3KB
Sample

250123-r5cgkasqgs
MD5

e0fd0dc9c26bcb3e7e9e2789339bf1d3
SHA1

d7468b4baf4d3b56755b060be3eed34e608dd35d
SHA256

6dff95543349b52e92d24de0cec7a689dcc3e298dbcda9f92c9386af99351b1b
SHA512

46af172b18640ac17dad409dc0b7e4e08bb87477a13aec111ff3e9c1802d5cb17c694c8b78010e9941e7544d5c0f3e787e4c0f653ea038fefa3667489fda6746

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
162.254.34.31
Port:
587
Username:
[email protected]
Password:
M992uew1mw6Z
Email To:
[email protected]

Targets

- Target
  
  Doc_LOI.vbe
- Size
  
  8KB
- MD5
  
  608aa4b6781b5333f940f9d0a933313f
- SHA1
  
  72282fe231e6e43d0785188e5e8509ff9bd59b8c
- SHA256
  
  13d3a1cdba937a0d1dcf706e85b320da66b2cc1ec1193839319511688847abbc
- SHA512
  
  3dbf0e3538070a372adb492b771e8360b02f4f3c0cf09092493d0c9bf487eefb26a8ee3a468047f3f36b284f34325e21f6c77b7352ca9e38a20b53c092f2684c
- SSDEEP
  
  192:3eS9aNfePvTsC7kYna9INmRo4OCk01bB3K:tsmj7k4aaYRtOCLBa
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Blocklisted process makes network request

Checks computer location settings

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2