agenttesla

General

Target
2ec35b9e143f9788ead2a7514ac5d6a6.exe
Size 610KB
Sample201012-xpp3pn1d3s
SHA256 fc23fe967415672cbd925b8f8e1ab099003ba329592b4075fa36c8e53582f5cd
MD5 2ec35b9e143f9788ead2a7514ac5d6a6
SHA1 989c55520079eea403e4d43a84e09f5a87468eed
SHA512 dc62f9c815f35b65605d0605281796079ecc0e265b66ff9aa3e21d34e0616a32fc7cfa923bebba9163881416e5386a92ee1622930983ac667477d06d6bd3c35b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
Jesuschrist1405

Targets

- Target
  2ec35b9e143f9788ead2a7514ac5d6a6.exe
- Size 610KB
- SHA256 fc23fe967415672cbd925b8f8e1ab099003ba329592b4075fa36c8e53582f5cd
- MD5 2ec35b9e143f9788ead2a7514ac5d6a6
- SHA1 989c55520079eea403e4d43a84e09f5a87468eed
- SHA512 dc62f9c815f35b65605d0605281796079ecc0e265b66ff9aa3e21d34e0616a32fc7cfa923bebba9163881416e5386a92ee1622930983ac667477d06d6bd3c35b
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2