agenttesla | df8a78d8e65b19e1ca2cbf3b191ca983b92bea82f0096c37799db950237047cc | Triage

Sharing

General

Target

df8a78d8e65b19e1ca2cbf3b191ca983b92bea82f0096c37799db950237047cc
Size

1.7MB
Sample

250129-bxkj7szlcm
MD5

581b3874568bc934d1d86de2fc6a5813
SHA1

d99bf6e2bd205b68688f1a7b7ae0b93c9f42bfc4
SHA256

df8a78d8e65b19e1ca2cbf3b191ca983b92bea82f0096c37799db950237047cc
SHA512

3d85e5af664f126afcd7be0bf66a2b51b0d9d603e7ca175792ace331b4c43a78f779696c8d1fa85103f87396f2a562dd920e87ea2f880ca313ac6ca4993cbf7c
SSDEEP

24576:vAHnh+eWsN3skA4RV1Hom2KXFmIam3X3N5tBgHVYHrSJEwZ4lC5:Sh+ZkldoPK1XamH3N5U14rSniK

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
nXe0M~WkW&nJ

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.ercolina-usa.com
Port:
21
Username:
[email protected]
Password:
nXe0M~WkW&nJ

Targets

- Target
  
  QUOTATION#008699.exe
- Size
  
  1.2MB
- MD5
  
  28229c89ba14b8d90861dff029c36510
- SHA1
  
  cbfc9a108dee87651b0ccfacfe49001bb28bdb71
- SHA256
  
  0992dbf50dd535eebb99b7559eb3d7f6122fd4138920795fcb2efb70f662828a
- SHA512
  
  57e30c0257c3356e83bcd2bf7e92fab13f5b8285717acf2c87795fdd8c3218686c2a76dd7bc6e2d965b88a63d7110a12b86aa47d66a37be15998333097e82852
- SSDEEP
  
  24576:jAHnh+eWsN3skA4RV1Hom2KXFmIam3X3N5tBgHVYHrSJEwZ4lC5:uh+ZkldoPK1XamH3N5U14rSniK
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan