agenttesla | 04e076fa2c82050cc4e89d7ba58b3cedbdccc5995b7e414fbaa04f6f2c1e77c2

General

Target
ps_fyqhm5rTX6wJ_1776443205885.ps1
Size 992KB
Sample260427-skf5paet21
SHA256 04e076fa2c82050cc4e89d7ba58b3cedbdccc5995b7e414fbaa04f6f2c1e77c2
MD5 81dcae88e07d0327cfeaeb6707d93eec
SHA1 2179cbcda0d727eb7e371554bc895c31dd5605a5
SHA512 6c774714e27f4fee1372364b5d32b27cb72ba1ed45d8d2fbd75e4bb853aac88a0053b88401d35ec701b5b8eb79ba7438af35c4326fae4983831d1f5363e1d234
SSDEEP 24576:NZW95ClB97Eq6kDsqXvHE3kHxfWEGPfOeFppoWasyK8GzhX:E52BK4x+z3O145B
TLSH
T151253303BE16B56F59358B1CE1ADFE0A83D15E832518A0D7708650CF13FF3A89AAD45B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.abcebikes.com
Port
21
Username
[email protected]
Password
Kindi720725#

Targets

- Target
  ps_fyqhm5rTX6wJ_1776443205885.ps1
- Size 992KB
- SHA256 04e076fa2c82050cc4e89d7ba58b3cedbdccc5995b7e414fbaa04f6f2c1e77c2
- MD5 81dcae88e07d0327cfeaeb6707d93eec
- SHA1 2179cbcda0d727eb7e371554bc895c31dd5605a5
- SHA512 6c774714e27f4fee1372364b5d32b27cb72ba1ed45d8d2fbd75e4bb853aac88a0053b88401d35ec701b5b8eb79ba7438af35c4326fae4983831d1f5363e1d234
- SSDEEP 24576:NZW95ClB97Eq6kDsqXvHE3kHxfWEGPfOeFppoWasyK8GzhX:E52BK4x+z3O145B
- TLSH
  T151253303BE16B56F59358B1CE1ADFE0A83D15E832518A0D7708650CF13FF3A89AAD45B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Looks up external IP address via web service

ConfuserEx .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2