agenttesla

General

Target

TBL PAYMENT COPY.exe
Size

527KB
Sample

201109-kfbvgqhz3x
MD5

6379567925c7097a49aa88e9b0981f95
SHA1

ffb42a0da0e7855ecc339abb944f79e3597e6bd2
SHA256

10b2155331d3b0c7934808e52084c3911f82ece51f39836e3ef0e8db39ee9904
SHA512

c0b45c606cadd64144a9a0b8722582a045c7d3a358769e896b6d9245cfe3ee92bc7daab5d4459f3815bc12fc0e57d3582686cbb3dc73777e33f25f9396163c4f

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
Whyworry90#

Targets

- Target
  
  TBL PAYMENT COPY.exe
- Size
  
  527KB
- MD5
  
  6379567925c7097a49aa88e9b0981f95
- SHA1
  
  ffb42a0da0e7855ecc339abb944f79e3597e6bd2
- SHA256
  
  10b2155331d3b0c7934808e52084c3911f82ece51f39836e3ef0e8db39ee9904
- SHA512
  
  c0b45c606cadd64144a9a0b8722582a045c7d3a358769e896b6d9245cfe3ee92bc7daab5d4459f3815bc12fc0e57d3582686cbb3dc73777e33f25f9396163c4f
Score

10^/10

agenttesla coreentity keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- rezer0
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CoreEntity .NET Packer

AgentTesla Payload

rezer0

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2