agenttesla

General

Target
ORDEN DE COMPRA.pdf.exe
Size 1.1MB
Sample260129-kcrbpabv4c
SHA256 67a9288baf5c274fae60465c54accb0973ea5e570c4eb992de3c5babc16b8dae
MD5 bd8573f6ef3e7f4f45cb66c512a64bc5
SHA1 63ce5f89abe1fd99b0089fad0f3fbebef6215404
SHA512 dcaac47be16b3757e3bccd1ccfa2360e8d92e62331e4041853434a113f451267b41d8051977e2227f325a9bf114b1568d6c5a44bbcfd177fa91ea58f24a06c9f
SSDEEP 12288:ugoCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7Q5aHh3ZXRaWnXENstqWrTGhksSfx:ulfMs1hsAdBen2pqpUrXpX1PTuXar5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
6E3@9gG*8u&q%@=.

Targets

- Target
  ORDEN DE COMPRA.pdf.exe
- Size 1.1MB
- SHA256 67a9288baf5c274fae60465c54accb0973ea5e570c4eb992de3c5babc16b8dae
- MD5 bd8573f6ef3e7f4f45cb66c512a64bc5
- SHA1 63ce5f89abe1fd99b0089fad0f3fbebef6215404
- SHA512 dcaac47be16b3757e3bccd1ccfa2360e8d92e62331e4041853434a113f451267b41d8051977e2227f325a9bf114b1568d6c5a44bbcfd177fa91ea58f24a06c9f
- SSDEEP 12288:ugoCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7Q5aHh3ZXRaWnXENstqWrTGhksSfx:ulfMs1hsAdBen2pqpUrXpX1PTuXar5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

.NET Reactor proctector

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2