agenttesla

General

Target
PRODUCT_DETAILS.PDF.exe
Size 780KB
Sample200803-2lnd2ecfwe
SHA256 6960d585698d0353194d53afa7c6db5a68386fa8855cefefe9a2f4ce1292b5da
MD5 f73c222727f2ed1fdeb93c6dca328867
SHA1 57b89bf08a8603a20127b65cb74974873819835e
SHA512 bbe9f60cb411b3ab8b3438009a765db5c1717ee4d12d99d6de22c20ea6699b027b8609f092a7114db3323b1cc400c24b2def55fae7e8554d5564aeb3e0775711
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.skibokshotell.no/
Port
21
Username
[email protected]
Password
A?}GsQdPT.%#

Credentials

Protocol
ftp
Host
ftp://ftp.skibokshotell.no/
Port
21
Username
[email protected]
Password
A?}GsQdPT.%#

Targets

- Target
  PRODUCT_DETAILS.PDF.exe
- Size 780KB
- SHA256 6960d585698d0353194d53afa7c6db5a68386fa8855cefefe9a2f4ce1292b5da
- MD5 f73c222727f2ed1fdeb93c6dca328867
- SHA1 57b89bf08a8603a20127b65cb74974873819835e
- SHA512 bbe9f60cb411b3ab8b3438009a765db5c1717ee4d12d99d6de22c20ea6699b027b8609f092a7114db3323b1cc400c24b2def55fae7e8554d5564aeb3e0775711
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2