agenttesla

General

Target
comeINV0007576.exe
Size 1000KB
Sample200731-rnvtjs2rhn
SHA256 b7d226784dbf8f2a77af4b279116c799e50e20c99154baed7bfac4c91d5c9b2c
MD5 e27dc9dad12426a13a217a2a8ca524ac
SHA1 11af13d900a8f4a5672a27fac874e5b2db356194
SHA512 d07366382ae4b70a0f7d9cdffcf3c768aeceb98f6f9a85b6fbf18e06504712d301505332108ece7ea0b8768f88caa9fbe456382dc47c22632a173094f16d2c74
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.konchilakis.gr
Port
587
Username
[email protected]
Password
Tiger@456

Targets

- Target
  comeINV0007576.exe
- Size 1000KB
- SHA256 b7d226784dbf8f2a77af4b279116c799e50e20c99154baed7bfac4c91d5c9b2c
- MD5 e27dc9dad12426a13a217a2a8ca524ac
- SHA1 11af13d900a8f4a5672a27fac874e5b2db356194
- SHA512 d07366382ae4b70a0f7d9cdffcf3c768aeceb98f6f9a85b6fbf18e06504712d301505332108ece7ea0b8768f88caa9fbe456382dc47c22632a173094f16d2c74
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Executes dropped EXE

Drops startup file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2