agenttesla | 2157d5e624b87bdf43d26bbf90a87b1e8b33c8a75b7f37bc7c0da20efcf4c873

General

Target
KO6QMN4W.ps1
Size 948KB
Sample260426-b2374sb15v
SHA256 2157d5e624b87bdf43d26bbf90a87b1e8b33c8a75b7f37bc7c0da20efcf4c873
MD5 2dd2a87dd1f57ad05321c33ce740aa13
SHA1 5240f77202672b713b5d4a1ae7995e1ae7c951ec
SHA512 eaa8c211dff41457a885425d360f8bd8cb27621d259b55e6f92df27e1c091d416ce7846bf2c600f15411c52a6aadea3ff3238e2d5724ef61e829c3070d918fe9
SSDEEP 24576:EbZyQAAN+mS5ZAJsjHu3v+r4fvccNmhWJmko/g:2PfSG+SzD
TLSH
T1D92533701C865DB6087DAA8F4A7BD71BE8B50F27E47510D5328C38C913267F890EBA76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
Z5Bd-plv]UUB0{Sd

Targets

- Target
  KO6QMN4W.ps1
- Size 948KB
- SHA256 2157d5e624b87bdf43d26bbf90a87b1e8b33c8a75b7f37bc7c0da20efcf4c873
- MD5 2dd2a87dd1f57ad05321c33ce740aa13
- SHA1 5240f77202672b713b5d4a1ae7995e1ae7c951ec
- SHA512 eaa8c211dff41457a885425d360f8bd8cb27621d259b55e6f92df27e1c091d416ce7846bf2c600f15411c52a6aadea3ff3238e2d5724ef61e829c3070d918fe9
- SSDEEP 24576:EbZyQAAN+mS5ZAJsjHu3v+r4fvccNmhWJmko/g:2PfSG+SzD
- TLSH
  T1D92533701C865DB6087DAA8F4A7BD71BE8B50F27E47510D5328C38C913267F890EBA76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Looks up external IP address via web service

ConfuserEx .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2