agenttesla | 7459fa57994fec5feaf7b3b2af8d38309777dcace1784bb3b17e23212f00cd9e

General

Target
ps_du7kYAULa1bq_1776239905794.ps1
Size 1012KB
Sample260427-skftxset2y
SHA256 7459fa57994fec5feaf7b3b2af8d38309777dcace1784bb3b17e23212f00cd9e
MD5 71a977d5b33f85519654828a104888b7
SHA1 7502829f486997e2d2003c9ff975ca32a4d67f03
SHA512 ca5739cea1262e22dc6e67d481a193de21317981b137ec300fa8ade3f66a0d1bf30e9a35082f49b354b268ebbd5c86cb372d4a9678d4d755533c5fa0adaa2de3
SSDEEP 12288:TrbtuQCSa6EYsPJOr5/9Q8M9r6IN06pL5Ua/7GER69/k/AT9OX71LmWfXP+SHBRa:fd7K0r5Vq/yIVL/ATUXhLx+SjBRcd
TLSH
T1232533A27EDD98FAC1B5923D623AFF975B717BB34C96884A125110C02E2DF4503EB1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.hhautoinvestment.co.tz
Port
21
Username
[email protected]
Password
V94I4~KnJnvK.Ugs

Targets

- Target
  ps_du7kYAULa1bq_1776239905794.ps1
- Size 1012KB
- SHA256 7459fa57994fec5feaf7b3b2af8d38309777dcace1784bb3b17e23212f00cd9e
- MD5 71a977d5b33f85519654828a104888b7
- SHA1 7502829f486997e2d2003c9ff975ca32a4d67f03
- SHA512 ca5739cea1262e22dc6e67d481a193de21317981b137ec300fa8ade3f66a0d1bf30e9a35082f49b354b268ebbd5c86cb372d4a9678d4d755533c5fa0adaa2de3
- SSDEEP 12288:TrbtuQCSa6EYsPJOr5/9Q8M9r6IN06pL5Ua/7GER69/k/AT9OX71LmWfXP+SHBRa:fd7K0r5Vq/yIVL/ATUXhLx+SjBRcd
- TLSH
  T1232533A27EDD98FAC1B5923D623AFF975B717BB34C96884A125110C02E2DF4503EB1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Looks up external IP address via web service

ConfuserEx .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2