agenttesla

General

Target
OVERDUE ACCOUNT LETTER- FINAL REMINDER.exe
Size 1.4MB
Sample250327-hjmwqsyshs
SHA256 f888c4770bbbbcad15c357d6731ff8f5afd7e62e4c35652f3dc3ede6c36b66e9
MD5 3b8df9d91686abf51fd6db510ca8a9ed
SHA1 52296a689e0d9c07a5eb018c21fdfeb64c0239c6
SHA512 8b7d4017b747e680aef9eaa9ecea91a1e6295c69e4a5ee846b6159fbf6a7ddd0668cb54ff9006682b0d17f33054ad0a67a74e89ae8c9aa3ccc69d5ba0a31371f
SSDEEP 24576:Ae8Sdf0hsacM3n3CzewoMIUrZMVo6b+G5JiZTnkrd++9c4350s:GSpgsaXnW26mt+GKTK1aA50s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iaa-airferight.com
Port
587
Username
[email protected]
Password
BIGNAIRA2024
Email to
[email protected]

Targets

- Target
  OVERDUE ACCOUNT LETTER- FINAL REMINDER.exe
- Size 1.4MB
- SHA256 f888c4770bbbbcad15c357d6731ff8f5afd7e62e4c35652f3dc3ede6c36b66e9
- MD5 3b8df9d91686abf51fd6db510ca8a9ed
- SHA1 52296a689e0d9c07a5eb018c21fdfeb64c0239c6
- SHA512 8b7d4017b747e680aef9eaa9ecea91a1e6295c69e4a5ee846b6159fbf6a7ddd0668cb54ff9006682b0d17f33054ad0a67a74e89ae8c9aa3ccc69d5ba0a31371f
- SSDEEP 24576:Ae8Sdf0hsacM3n3CzewoMIUrZMVo6b+G5JiZTnkrd++9c4350s:GSpgsaXnW26mt+GKTK1aA50s
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2