agenttesla

General

Target
DHL - NINGBO OVERDUE INVOICES- FINAL REMINDER - 456034158.exe
Size 1.4MB
Sample250305-h77wtasps2
SHA256 a0b93473fe0aa4e5df49542aea136c8b037d85e4bae90eb5f55922e18ce6b804
MD5 b18738ef41f5d17b9827dc2e2d311e06
SHA1 2e009d08324a6a33110ba2b479785df04c64748c
SHA512 f76e0d1ccc539258f6d748df5e6d380b2c2c19a2d0276ec5dabc1658edbeb5272d3460511d5c3330787921d7936075b1d10a8b54e74c51859029e0e701270ca7
SSDEEP 24576:94U2VkcD4m5umT/6yF6LDrlTThKiCQDgmEPjCi9rZeJ1XA8I0l:QVkcUmMLlTfCQX+WaZebw8I0l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iaa-airferight.com
Port
587
Username
[email protected]
Password
BIGNAIRA2024
Email to
[email protected]

Targets

- Target
  DHL - NINGBO OVERDUE INVOICES- FINAL REMINDER - 456034158.exe
- Size 1.4MB
- SHA256 a0b93473fe0aa4e5df49542aea136c8b037d85e4bae90eb5f55922e18ce6b804
- MD5 b18738ef41f5d17b9827dc2e2d311e06
- SHA1 2e009d08324a6a33110ba2b479785df04c64748c
- SHA512 f76e0d1ccc539258f6d748df5e6d380b2c2c19a2d0276ec5dabc1658edbeb5272d3460511d5c3330787921d7936075b1d10a8b54e74c51859029e0e701270ca7
- SSDEEP 24576:94U2VkcD4m5umT/6yF6LDrlTThKiCQDgmEPjCi9rZeJ1XA8I0l:QVkcUmMLlTfCQX+WaZebw8I0l
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2