agenttesla

General

Target

0939489392303224233.exe
Size

778KB
Sample

201222-52l8mqqg1s
MD5

a4ac3bffccf0e754f4f99f3aa5d96539
SHA1

7965d7c3d7c308995157b510787c57c7b9f0b4dc
SHA256

e140e7b8d2a418255138c39902cd565cf588f1c29bd09936202b1eb3266fd331
SHA512

c58fdfa463901c4368a3a79d0315782d9bcd86a9827bbcccd311988e5497e1c8c8dba20f2c410ac8995979cb3782c833d0d93657b77b74bc80e1092a4ec83815

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.a-t-mould.com
Port:
587
Username:
obi@a-t-mould.com
Password:
xbNoSad?0Xlc

Targets

- Target
  
  0939489392303224233.exe
- Size
  
  778KB
- MD5
  
  a4ac3bffccf0e754f4f99f3aa5d96539
- SHA1
  
  7965d7c3d7c308995157b510787c57c7b9f0b4dc
- SHA256
  
  e140e7b8d2a418255138c39902cd565cf588f1c29bd09936202b1eb3266fd331
- SHA512
  
  c58fdfa463901c4368a3a79d0315782d9bcd86a9827bbcccd311988e5497e1c8c8dba20f2c410ac8995979cb3782c833d0d93657b77b74bc80e1092a4ec83815
Score

10^/10

agenttesla modiloader keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- AgentTesla Payload
- ModiLoader First Stage
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

ModiLoader, DBatLoader

AgentTesla Payload

ModiLoader First Stage

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2