agenttesla

General

Target
b0156f6e3597a4c58a87b8e64a85fe5988c2de3608b3e10a51c190c4620fe9cb
Size 514KB
Sample250127-2qctwsynbm
SHA256 b0156f6e3597a4c58a87b8e64a85fe5988c2de3608b3e10a51c190c4620fe9cb
MD5 27c667fd07d70c2317fa1ea42679ec70
SHA1 cea626029b09b31517a611b6e8191ae86e40e6c9
SHA512 a6af6f9c4cef5e5ec80bddf14b9c7d9e51cb8049bd0700685cfb5b538f15f4f383e1473194a8acb668b07f1561b32fdcc518c9b83564fc7c3583cdd9fa0455d9
SSDEEP 12288:zHWZ2ysM9RZ1/uXIp37iboV6c9nopS3rIl/DzU+IwlB:z2ZIMzZ9uY58o7qermfIC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.gizemetiket.com.tr
Port
21
Username
pgizemM6
Password
giz95Ffg

Targets

- Target
  Orden de compra N05674.exe
- Size 867KB
- SHA256 190fe375bcfe2812fc4f94266fcf19b2a8527b1b7f31e63caa1a6b9c00c34c53
- MD5 16b23de1b7e00c46c6900bee2025973f
- SHA1 443545677090d662e1f1b2e20bef8c0ac5110f99
- SHA512 551923d313edf7c6822ab1f70d0cad2e7faedccc58feb3c690b620278718cdd9ea621a5ef83f34e1cc595df4d8e7751f8ae0db8adb3b6935fe7396cd8c886f80
- SSDEEP 12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCx/D7Hr2mIqTMB/F9ZbrD:uRmJkcoQricOIQxiZY1iaCxCrqTCNbrD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2