agenttesla

General

Target
16764722754134sdfnt42.pdf.exe
Size 555KB
Sample201109-gpkarfmyme
SHA256 e0467337d731f38bd8215652a767fdbae5fa1c6a9d4dfe75a995a221ae2f5750
MD5 c3b3a69a830f2ec41218248be55b41fc
SHA1 a80cbd76b73cd0f4cc8d9f62e352d807f2abd485
SHA512 00e13d050f791fb5b6021b69f59fe7732313a58be08fff6b0b215cb13a49b755b50517703cb6d2d8f99e9423ae62306cf916fab1108387be50b06fab1322b825
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
princehero1234

Targets

- Target
  16764722754134sdfnt42.pdf.exe
- Size 555KB
- SHA256 e0467337d731f38bd8215652a767fdbae5fa1c6a9d4dfe75a995a221ae2f5750
- MD5 c3b3a69a830f2ec41218248be55b41fc
- SHA1 a80cbd76b73cd0f4cc8d9f62e352d807f2abd485
- SHA512 00e13d050f791fb5b6021b69f59fe7732313a58be08fff6b0b215cb13a49b755b50517703cb6d2d8f99e9423ae62306cf916fab1108387be50b06fab1322b825
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Maps connected drives based on registry

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2