agenttesla | 0992dbf50dd535eebb99b7559eb3d7f6122fd4138920795fcb2efb70f662828a | Triage

Sharing

General

Target

0992dbf50dd535eebb99b7559eb3d7f6122fd4138920795fcb2efb70f662828a
Size

1.2MB
Sample

250129-bvk3yswqgy
MD5

28229c89ba14b8d90861dff029c36510
SHA1

cbfc9a108dee87651b0ccfacfe49001bb28bdb71
SHA256

0992dbf50dd535eebb99b7559eb3d7f6122fd4138920795fcb2efb70f662828a
SHA512

57e30c0257c3356e83bcd2bf7e92fab13f5b8285717acf2c87795fdd8c3218686c2a76dd7bc6e2d965b88a63d7110a12b86aa47d66a37be15998333097e82852
SSDEEP

24576:jAHnh+eWsN3skA4RV1Hom2KXFmIam3X3N5tBgHVYHrSJEwZ4lC5:uh+ZkldoPK1XamH3N5U14rSniK

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
nXe0M~WkW&nJ

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
nXe0M~WkW&nJ

Targets

- Target
  
  0992dbf50dd535eebb99b7559eb3d7f6122fd4138920795fcb2efb70f662828a
- Size
  
  1.2MB
- MD5
  
  28229c89ba14b8d90861dff029c36510
- SHA1
  
  cbfc9a108dee87651b0ccfacfe49001bb28bdb71
- SHA256
  
  0992dbf50dd535eebb99b7559eb3d7f6122fd4138920795fcb2efb70f662828a
- SHA512
  
  57e30c0257c3356e83bcd2bf7e92fab13f5b8285717acf2c87795fdd8c3218686c2a76dd7bc6e2d965b88a63d7110a12b86aa47d66a37be15998333097e82852
- SSDEEP
  
  24576:jAHnh+eWsN3skA4RV1Hom2KXFmIam3X3N5tBgHVYHrSJEwZ4lC5:uh+ZkldoPK1XamH3N5U14rSniK
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan