agenttesla

General

Target
SOA - HUAFENG (JAN INVOICE OVERDUE).exe
Size 1.2MB
Sample250314-tde5gstyfv
SHA256 df52744df9ff4bd8dfb0b6e6e86f94d1d885caba0f2deb2f8a429978b475508a
MD5 eb11183b01282bd6a62280b200b6a52f
SHA1 5c45eb1ee3f5a16b226eeaa8f637287b4e93bbee
SHA512 d802b19c2684225c594e75aa5bf0a51386a434acc1302e7f31fa4e02494232c96de2bf29ce72556ae175ad3e9252e257305b5c39c9419798f74f77895f577d4a
SSDEEP 24576:Zmuil1zWDv0GtEg9iNVqB6dDG5Ts8uN3IbpUcGMatXpfDG:JiU8GtALqS84pNCpUltXJG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iaa-airferight.com
Port
587
Username
[email protected]
Password
BIGNAIRA2024
Email to
[email protected]

Targets

- Target
  SOA - HUAFENG (JAN INVOICE OVERDUE).exe
- Size 1.2MB
- SHA256 df52744df9ff4bd8dfb0b6e6e86f94d1d885caba0f2deb2f8a429978b475508a
- MD5 eb11183b01282bd6a62280b200b6a52f
- SHA1 5c45eb1ee3f5a16b226eeaa8f637287b4e93bbee
- SHA512 d802b19c2684225c594e75aa5bf0a51386a434acc1302e7f31fa4e02494232c96de2bf29ce72556ae175ad3e9252e257305b5c39c9419798f74f77895f577d4a
- SSDEEP 24576:Zmuil1zWDv0GtEg9iNVqB6dDG5Ts8uN3IbpUcGMatXpfDG:JiU8GtALqS84pNCpUltXJG
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2