agenttesla

General

Target

4b747bf2671ac0c7247a4a55c99a556f59ae04c11b601957b11bf03d2497c69c_NeikiAnalytics.exe
Size

1.3MB
Sample

240701-mqtebazenn
MD5

7f5000bb9ec3c3f32aa4fcd41a4e7450
SHA1

90302c51dde6986d69b17a397178aa45d95c7635
SHA256

4b747bf2671ac0c7247a4a55c99a556f59ae04c11b601957b11bf03d2497c69c
SHA512

c8868804c86a255114cb36cf44612c3124487a77ceb9aafd0a74bd6ec9c514851159b49ca7ec3994c2e7cca1e4ec5bef2bc8702ebec10b7aac517299e1ac8f32
SSDEEP

12288:PKkMu/PPZCSk+KzMKduKedQyMCMahc/Xcoj8MwFm5wWmmZuAQLCNtgIF8iWbBFe3:9IG6SMajZMi0/m2u7ONtt1WNFGf

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7132889766:AAFJvPkiK-1rv-CJQ2hQXEL_CYzO_zi018g/

Targets

- Target
  
  4b747bf2671ac0c7247a4a55c99a556f59ae04c11b601957b11bf03d2497c69c_NeikiAnalytics.exe
- Size
  
  1.3MB
- MD5
  
  7f5000bb9ec3c3f32aa4fcd41a4e7450
- SHA1
  
  90302c51dde6986d69b17a397178aa45d95c7635
- SHA256
  
  4b747bf2671ac0c7247a4a55c99a556f59ae04c11b601957b11bf03d2497c69c
- SHA512
  
  c8868804c86a255114cb36cf44612c3124487a77ceb9aafd0a74bd6ec9c514851159b49ca7ec3994c2e7cca1e4ec5bef2bc8702ebec10b7aac517299e1ac8f32
- SSDEEP
  
  12288:PKkMu/PPZCSk+KzMKduKedQyMCMahc/Xcoj8MwFm5wWmmZuAQLCNtgIF8iWbBFe3:9IG6SMajZMi0/m2u7ONtt1WNFGf
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2