agenttesla

General

Target
SMEC SX#ATUSG02.COM
Size 1.7MB
Sample210316-dtkftbtw46
SHA256 d8a41a28c498d512310f9acfe5c44c6d22daa445d522cd53bd80bb4b2fddf2ac
MD5 e10b9d568489db75b16c7ccceffcefbf
SHA1 a1bca9249818ada8e6b5cba17210860e5f041768
SHA512 a22484175d5faa24ed2327b4b931e820a68f44f165f0273794d274384c11e4bbb773ede9b0bf65c12ee19f0b7e5c5a02cd0e49d07754d940daa865565f0e3106
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.vincnetsystems.de
Port
587
Username
[email protected]
Password
^PFybvG0

Targets

- Target
  SMEC SX#ATUSG02.COM
- Size 1.7MB
- SHA256 d8a41a28c498d512310f9acfe5c44c6d22daa445d522cd53bd80bb4b2fddf2ac
- MD5 e10b9d568489db75b16c7ccceffcefbf
- SHA1 a1bca9249818ada8e6b5cba17210860e5f041768
- SHA512 a22484175d5faa24ed2327b4b931e820a68f44f165f0273794d274384c11e4bbb773ede9b0bf65c12ee19f0b7e5c5a02cd0e49d07754d940daa865565f0e3106
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2