agenttesla

General

Target
f9ec4a38ce7cfeabf581dab7d37cc517d87d43d517c5ded00b333889241beccf.exe
Size 1.1MB
Sample260306-ryblpagv5m
SHA256 f9ec4a38ce7cfeabf581dab7d37cc517d87d43d517c5ded00b333889241beccf
MD5 c290257e8d2f6202ac4717a53195997c
SHA1 4bed7b726d2b24f764ac4ce1c0b365fa17a71fbb
SHA512 2fcc0cce1e86e53f3d92b1e343dc97f9eaa536d8f529c7a4dee2027abf3ca349559a417c6c4730f5e52090d896d4b52b83ad4af7f31892b44ae227d386445be1
SSDEEP 24576:O5EmXFtKaL4/oFe5T9yyXYfP1ijXdax6WgSzLL+CGRz:OPVt/LZeJbInQRax6Wzv/G
TLSH
T1DB35AE027391C062FFAB91334B56F6115BBD79260123E62F13981DBABE701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Targets

- Target
  f9ec4a38ce7cfeabf581dab7d37cc517d87d43d517c5ded00b333889241beccf.exe
- Size 1.1MB
- SHA256 f9ec4a38ce7cfeabf581dab7d37cc517d87d43d517c5ded00b333889241beccf
- MD5 c290257e8d2f6202ac4717a53195997c
- SHA1 4bed7b726d2b24f764ac4ce1c0b365fa17a71fbb
- SHA512 2fcc0cce1e86e53f3d92b1e343dc97f9eaa536d8f529c7a4dee2027abf3ca349559a417c6c4730f5e52090d896d4b52b83ad4af7f31892b44ae227d386445be1
- SSDEEP 24576:O5EmXFtKaL4/oFe5T9yyXYfP1ijXdax6WgSzLL+CGRz:OPVt/LZeJbInQRax6Wzv/G
- TLSH
  T1DB35AE027391C062FFAB91334B56F6115BBD79260123E62F13981DBABE701B1563E7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops startup file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Drops startup file

Executes dropped EXE

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2