agenttesla

General

Target
PO 45-1982020,pdf.scr
Size 5.0MB
Sample200819-yyxqfatbws
SHA256 34914f4c50c096b6fdd81a5b4e4459e52cc0d5e6527a7edef207e81592ea4709
MD5 f58aa4547c0420baae289aeeb1bed27e
SHA1 b2e96c72e8ab9a7d2c3cf84dc07e5270d9480ebd
SHA512 57cdf65483b677efb75873c4778a7732afa32ff166e1408d8115debb108d62e6ba7ec022326ce4e91d852332bdd71e3cb0cea6a3bf0b18304803e770f49ce636
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
sparedone

Targets

- Target
  PO 45-1982020,pdf.scr
- Size 5.0MB
- SHA256 34914f4c50c096b6fdd81a5b4e4459e52cc0d5e6527a7edef207e81592ea4709
- MD5 f58aa4547c0420baae289aeeb1bed27e
- SHA1 b2e96c72e8ab9a7d2c3cf84dc07e5270d9480ebd
- SHA512 57cdf65483b677efb75873c4778a7732afa32ff166e1408d8115debb108d62e6ba7ec022326ce4e91d852332bdd71e3cb0cea6a3bf0b18304803e770f49ce636
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies WinLogon for persistence
  persistence
- AgentTesla Payload
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies WinLogon for persistence

AgentTesla Payload

Drops startup file

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2