agenttesla

General

Target
Cesión de Créditos.exe
Size 586KB
Sample201109-e61crmw6xa
SHA256 2890defa015590771a48e957d5a81dc2f2a6a86b784a8764f135cdd72f0d4e7d
MD5 b6fdb347eca8545836f866dcc3c3ec81
SHA1 627e32969390cebf42e5d13136cc62c0be8f55b0
SHA512 5df78c54f182254f0489f111245d35c513183f4df7b848510a4c75476dd6f0afef2d8c6dfd74debc295022ad11c33a078268089f5300b4ea3a2e02ca2fa225c4
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.ru
Port
587
Username
[email protected]
Password
Good1234

Targets

- Target
  Cesión de Créditos.exe
- Size 586KB
- SHA256 2890defa015590771a48e957d5a81dc2f2a6a86b784a8764f135cdd72f0d4e7d
- MD5 b6fdb347eca8545836f866dcc3c3ec81
- SHA1 627e32969390cebf42e5d13136cc62c0be8f55b0
- SHA512 5df78c54f182254f0489f111245d35c513183f4df7b848510a4c75476dd6f0afef2d8c6dfd74debc295022ad11c33a078268089f5300b4ea3a2e02ca2fa225c4
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Maps connected drives based on registry

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2