agenttesla | 94d6415021f1939fe6add14c3d5169ecdd7cd8240bad6b55cdda581633b039f0

General

Target
MV_LIBRETY_KING_V_VSL_INFORMATIONS.zip
Size 361KB
Sample260415-ranw4saz2x
SHA256 94d6415021f1939fe6add14c3d5169ecdd7cd8240bad6b55cdda581633b039f0
MD5 28c60e5d4caa8f0fd6175a8f4cc3d0fc
SHA1 e63a94f33f8ddf5ebbf38b8db9c87f492ac546ac
SHA512 530cc5abf06caede9d0e944a0dae3a718a788a88f7ed227c48e2cdb3ae4fda3c46add6ecba10f8eafac97c9565435e9ab8b22957bcb2f4275e104c53169b87bc
SSDEEP 6144:FmyLK5ofeDxOC9NAS0WTTGPPSHa/71dUAO69CvVczbjk74XCZxXY0iWdvD9wI9Ev:FmK6xh9b0YsPSHa/71d9h+cXjfI+VWrO
TLSH
T14F74233F8DE3AD3D27D191AD603769C08321D253F42EE1DCA36C66856423B796AD728C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.onionmail.org
Port
587
Username
[email protected]
Password
sendboxorigin12
Email to
[email protected]

Targets

- Target
  MV_LIBRETY_KING_V_VSL_INFORMATIONS.exe
- Size 649KB
- SHA256 40bfdb62bcd0ad5f2c09f33df6ce43f61e2da683ae7ae86cd479c8d567612780
- MD5 7c85464ebcf6da92b5fae1bebe2a29d7
- SHA1 91c0b580788c4f82c3f9e0e01f76490e4bdef905
- SHA512 1ad5368f31276e7ddec6d75767eb3fe215f8f73796684037ef2463d0daa944fd7dedb9a255975410c3f408a56e9f0948e4b243e7617f22c10a5541a37ea14896
- SSDEEP 12288:mdX9s4H7pg1bqvp0ysPSHa971dphecXjLcCVWxwS95nnnHnnntnnnNnnnunnn:EubqR0yPHa9xjXj/ir5nnnGnnn
- TLSH
  T1B9E4C05A2C9D949AE2A14A7400E2B37D53FEA2D23E88D7D79E3D455D6D21CCCEE32D00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2