agenttesla | 25b1b876e1b2e7e0d8c426aed7fe0f8690a19cbe21da03ebbac61ec41a35e690

General

Target
factura(s)_y_recibo_de_pago7642.exe
Size 1.1MB
Sample260520-vkfv2aev8j
SHA256 25b1b876e1b2e7e0d8c426aed7fe0f8690a19cbe21da03ebbac61ec41a35e690
MD5 2e202636c37d8dbdacb3a08cbd55b7a1
SHA1 f7ad69b345d575e5a8c0566d1bc1afb59999f94a
SHA512 df717889a216ca0f535dca4b2c4b8beb742a1676c767f2d600b53c49f46567edab428846bb7f77b587b8196640b47e4e6f087911c0db1ef06c817cd140492d4f
SSDEEP 24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXda1EKB/rm0B6TPj/:lPVt/LZeJbInQRa1EKB/C0Bo
TLSH
T12B35BF0273D1C062FFAB91734B5AF6115BBC79260123A61F13981DBABE701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.gizemetiket.com.tr
Port
21
Username
pgizemM6
Password
giz95Ffg

Targets

- Target
  factura(s)_y_recibo_de_pago7642.exe
- Size 1.1MB
- SHA256 25b1b876e1b2e7e0d8c426aed7fe0f8690a19cbe21da03ebbac61ec41a35e690
- MD5 2e202636c37d8dbdacb3a08cbd55b7a1
- SHA1 f7ad69b345d575e5a8c0566d1bc1afb59999f94a
- SHA512 df717889a216ca0f535dca4b2c4b8beb742a1676c767f2d600b53c49f46567edab428846bb7f77b587b8196640b47e4e6f087911c0db1ef06c817cd140492d4f
- SSDEEP 24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXda1EKB/rm0B6TPj/:lPVt/LZeJbInQRa1EKB/C0Bo
- TLSH
  T12B35BF0273D1C062FFAB91734B5AF6115BBC79260123A61F13981DBABE701B1563E7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2