agenttesla

General

Target
DHL00117398292PDF.exe
Size 916KB
Sample200720-svmxyr5csj
SHA256 ed8a29488b2961a9036cba9f2701d2c07024c564b9e5e2a256547d5ddb6e7bc7
MD5 5a0aa4beaca455dd5d5c03af7ad0e68f
SHA1 7831975cc76206854fac68fb765415a890229704
SHA512 1de667ef1b77428a8f619c2cd721f1fca98877547b3e7623a6c552673019c50c938979715a662360899e560906197ae5a2c090b1d4a74a2f49548ec75de78f40
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.solarcenter.ro/
Port
21
Username
[email protected]
Password
G,*C8w!FpT6vRSv%AL{k~wATNN@ossyguru@00998877;,,z_sFo6BO5

Credentials

Protocol
ftp
Host
ftp://ftp.solarcenter.ro/
Port
21
Username
[email protected]
Password
G,*C8w!FpT6vRSv%AL{k~wATNN@ossyguru@00998877;,,z_sFo6BO5

Targets

- Target
  DHL00117398292PDF.exe
- Size 916KB
- SHA256 ed8a29488b2961a9036cba9f2701d2c07024c564b9e5e2a256547d5ddb6e7bc7
- MD5 5a0aa4beaca455dd5d5c03af7ad0e68f
- SHA1 7831975cc76206854fac68fb765415a890229704
- SHA512 1de667ef1b77428a8f619c2cd721f1fca98877547b3e7623a6c552673019c50c938979715a662360899e560906197ae5a2c090b1d4a74a2f49548ec75de78f40
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2