agenttesla | 3d87032556ac1435e7db7bb2c3b553f4c2fefbf7b85455314f5ccf135d705ba1 | Triage

Sharing

General

Target

2025-03-29_eb0d5f4c87b4b129cc70280695ef7039_black-basta_luca-stealer_metamorfo
Size

1.6MB
Sample

250329-dq5mxaylw2
MD5

eb0d5f4c87b4b129cc70280695ef7039
SHA1

f6a05c2eaadc051308604bbb0a61195084ea2a3b
SHA256

3d87032556ac1435e7db7bb2c3b553f4c2fefbf7b85455314f5ccf135d705ba1
SHA512

5bb6633c6e7de4ae218663a07dffc6a6c14ae76489ce5d6c4b98fcd061bccc8e0d488f52be313fa0c6b5a2d9b50d69d51bd3226bc79f85ac605ae4718c457a37
SSDEEP

24576:6NA3R5drX+dCfpuablsu4j0K2Dlu1m00/Gmo9z1Aj3eJ0zj:z52iJcj0g1m00Iz1Aj3uu

Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  2025-03-29_eb0d5f4c87b4b129cc70280695ef7039_black-basta_luca-stealer_metamorfo
- Size
  
  1.6MB
- MD5
  
  eb0d5f4c87b4b129cc70280695ef7039
- SHA1
  
  f6a05c2eaadc051308604bbb0a61195084ea2a3b
- SHA256
  
  3d87032556ac1435e7db7bb2c3b553f4c2fefbf7b85455314f5ccf135d705ba1
- SHA512
  
  5bb6633c6e7de4ae218663a07dffc6a6c14ae76489ce5d6c4b98fcd061bccc8e0d488f52be313fa0c6b5a2d9b50d69d51bd3226bc79f85ac605ae4718c457a37
- SSDEEP
  
  24576:6NA3R5drX+dCfpuablsu4j0K2Dlu1m00/Gmo9z1Aj3eJ0zj:z52iJcj0g1m00Iz1Aj3uu
Score

10^/10

discovery agenttesla collection credential_access keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan