agenttesla

General

Target
9c6fb8746b6cccb65cee1d12cfe9dd67
Size 1021KB
Sample201117-wnnr648v8a
SHA256 2e132b331b416b7480762cd12eda3fba08eeff73f54042c44247419a28450708
MD5 978a6935dc6c90106d7c08b9a5fa5cf0
SHA1 212c08a05b42ceab9cae969861dc305f0b784861
SHA512 0816ab65a3bf565993a3489e6225e1ff0ef36c1bf32f1a6e159fa346bf3093d18eaff12bb233029e0c30380299e70ca3db84f7ace45812fe08d396fce1dce82e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
india@123

Targets

- Target
  9c6fb8746b6cccb65cee1d12cfe9dd67
- Size 1021KB
- SHA256 2e132b331b416b7480762cd12eda3fba08eeff73f54042c44247419a28450708
- MD5 978a6935dc6c90106d7c08b9a5fa5cf0
- SHA1 212c08a05b42ceab9cae969861dc305f0b784861
- SHA512 0816ab65a3bf565993a3489e6225e1ff0ef36c1bf32f1a6e159fa346bf3093d18eaff12bb233029e0c30380299e70ca3db84f7ace45812fe08d396fce1dce82e
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2