agenttesla | 74164a66eb155d2ef2e03a806a6247ac47c1b5a2cb4c69576f36f00397dd57bd

General

Target
_74164a66eb155d2ef2e03a806a6247ac47c1b5a2cb4c69576f36f00397dd57bd.exe
Size 649KB
Sample260415-d3159ad15k
SHA256 74164a66eb155d2ef2e03a806a6247ac47c1b5a2cb4c69576f36f00397dd57bd
MD5 1b7207725c64d455be983e3b1041dd33
SHA1 6119708d963249a92725376c9dfa72e6069f9ec8
SHA512 7e7ded6dd9cf707514afec7e706c505a84224db98a8ecb027a2a8e9a9aaf9de54e0f7443620af55aef9d84780744d7d44a764731876ad0a65df39abb729f23f8
SSDEEP 12288:mdX9s4H7pg1bDU7TzwbNUh0ajwVnnnHnnntnnnNnnnunnn:EubDUfkbNUh7wVnnnGnnn
TLSH
T132E4CF5A2C9D959AE2A14A7440E2B33D53FF62D23F88DBD79D2C495D6D21CCCEE22D00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.onionmail.org
Port
587
Username
[email protected]
Password
sendboxorigin12
Email to
[email protected]

Targets

- Target
  _74164a66eb155d2ef2e03a806a6247ac47c1b5a2cb4c69576f36f00397dd57bd.exe
- Size 649KB
- SHA256 74164a66eb155d2ef2e03a806a6247ac47c1b5a2cb4c69576f36f00397dd57bd
- MD5 1b7207725c64d455be983e3b1041dd33
- SHA1 6119708d963249a92725376c9dfa72e6069f9ec8
- SHA512 7e7ded6dd9cf707514afec7e706c505a84224db98a8ecb027a2a8e9a9aaf9de54e0f7443620af55aef9d84780744d7d44a764731876ad0a65df39abb729f23f8
- SSDEEP 12288:mdX9s4H7pg1bDU7TzwbNUh0ajwVnnnHnnntnnnNnnnunnn:EubDUfkbNUh7wVnnnGnnn
- TLSH
  T132E4CF5A2C9D959AE2A14A7440E2B33D53FF62D23F88DBD79D2C495D6D21CCCEE22D00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2