agenttesla

General

Target
H8pkkXDMNSesvys.exe
Size 524KB
Sample201109-vdap1eew9n
SHA256 e909cbf5a12f8309b93746f877cb4cdf0b8a41d07c4b2badbf917748679213d2
MD5 876593a2d1bede193fcc3ef81b5eef4e
SHA1 5ad79510851f743bb4be257e36a6a0729c5679d3
SHA512 1290c80cbd1b81bd3cb845160ee0e513cf186355a5fa4bd91dc02b4ca2cf8a5b06ff31d7db1ca7f9add5062ee92bf52a77f9a56be01f872b10e9b49d3f64af98
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
09012345@

Targets

- Target
  H8pkkXDMNSesvys.exe
- Size 524KB
- SHA256 e909cbf5a12f8309b93746f877cb4cdf0b8a41d07c4b2badbf917748679213d2
- MD5 876593a2d1bede193fcc3ef81b5eef4e
- SHA1 5ad79510851f743bb4be257e36a6a0729c5679d3
- SHA512 1290c80cbd1b81bd3cb845160ee0e513cf186355a5fa4bd91dc02b4ca2cf8a5b06ff31d7db1ca7f9add5062ee92bf52a77f9a56be01f872b10e9b49d3f64af98
- MD5 SHA1 SHA512
Score

10^/10

agenttesla coreentity keylogger rezer0 spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- AgentTesla Payload
- rezer0
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CoreEntity .NET Packer

AgentTesla Payload

rezer0

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2