agenttesla

General

Target

996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35.exe
Size

758KB
Sample

250124-ft3ntsspeq
MD5

2470914fd04c28516223c5414055b846
SHA1

fcfbc9fb662ecfb654292739da72817ccfbd721c
SHA256

996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
SHA512

956f49c92c6b84398036e3c50323f20bf76a059b767835ee63d2b957004119aeaf45cd24c33c1ec415c5922cc8969d848a06a3ef2bf1998972a2f6bbbd98352a
SSDEEP

12288:v6Wq4aaE6KwyF5L0Y2D1PqLfIrJFq3w9i+6alvoD2FUfMM41jkw2m1eYHkDon5wk:tthEVaPqLfIFFq3h+640rSTkDs7n

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Targets

- Target
  
  996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35.exe
- Size
  
  758KB
- MD5
  
  2470914fd04c28516223c5414055b846
- SHA1
  
  fcfbc9fb662ecfb654292739da72817ccfbd721c
- SHA256
  
  996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
- SHA512
  
  956f49c92c6b84398036e3c50323f20bf76a059b767835ee63d2b957004119aeaf45cd24c33c1ec415c5922cc8969d848a06a3ef2bf1998972a2f6bbbd98352a
- SSDEEP
  
  12288:v6Wq4aaE6KwyF5L0Y2D1PqLfIrJFq3w9i+6alvoD2FUfMM41jkw2m1eYHkDon5wk:tthEVaPqLfIFFq3h+640rSTkDs7n
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2