agenttesla

General

Target
PaymentNotification.exe
Size 799KB
Sample200813-rmbh6krsts
SHA256 254c1b8ff86ebe8a88aacb3172ea4c05289dc129d3364189bcdfd097e5f5ef6f
MD5 3d1f01ee6a478c9beba11ea23bc23854
SHA1 8f11bc5561afe39a05dbef7730a4ca19728b0111
SHA512 6168dd6797d2c1fb4721be8819e6972e184980e34f35b48d7fad5d7be054ca9ea7fb82b5277cc84497ff07b42715dd24be9c2873335e05e3b7eacea343c5d5d8
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.intelligentprotection.co.za
Port
587
Username
[email protected]
Password
^RBH}Ta%za[I

Targets

- Target
  PaymentNotification.exe
- Size 799KB
- SHA256 254c1b8ff86ebe8a88aacb3172ea4c05289dc129d3364189bcdfd097e5f5ef6f
- MD5 3d1f01ee6a478c9beba11ea23bc23854
- SHA1 8f11bc5561afe39a05dbef7730a4ca19728b0111
- SHA512 6168dd6797d2c1fb4721be8819e6972e184980e34f35b48d7fad5d7be054ca9ea7fb82b5277cc84497ff07b42715dd24be9c2873335e05e3b7eacea343c5d5d8
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

UPX packed file

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2