agenttesla

General

Target

00c26563b4b8f31c19d53446857023c81e59b0acc3fb3c268f304af79862d406
Size

860KB
Sample

250128-bnrxxsskbz
MD5

7c037be9848f41dcd63da4244c6d060a
SHA1

4e2e8e25f2ac276f6a5b5abceddd0fdbf7940b45
SHA256

00c26563b4b8f31c19d53446857023c81e59b0acc3fb3c268f304af79862d406
SHA512

9436b2f61b2d5c0a9bdb86829459704347c89c0ef50479d81f5ad0357fbb5fe40392e521c4439afe5cbd8fca40773cfc1c129be588d0ca08e4e45ce5bc5b0c85
SSDEEP

24576:LRmJkcoQricOIQxiZY1WNy7RxKdCij1IN:IJZoQrbTFZY1WNyCC21IN

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Targets

- Target
  
  00c26563b4b8f31c19d53446857023c81e59b0acc3fb3c268f304af79862d406
- Size
  
  860KB
- MD5
  
  7c037be9848f41dcd63da4244c6d060a
- SHA1
  
  4e2e8e25f2ac276f6a5b5abceddd0fdbf7940b45
- SHA256
  
  00c26563b4b8f31c19d53446857023c81e59b0acc3fb3c268f304af79862d406
- SHA512
  
  9436b2f61b2d5c0a9bdb86829459704347c89c0ef50479d81f5ad0357fbb5fe40392e521c4439afe5cbd8fca40773cfc1c129be588d0ca08e4e45ce5bc5b0c85
- SSDEEP
  
  24576:LRmJkcoQricOIQxiZY1WNy7RxKdCij1IN:IJZoQrbTFZY1WNyCC21IN
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2