agenttesla

General

Target
174579a122e1afba0000181b4ea93c15
Size 928KB
Sample210610-qb3fejkv82
SHA256 cb8a7d1d9c86d996899769e9abac0b326053dae7f9d8fc226aabfa89f3f8d16e
MD5 174579a122e1afba0000181b4ea93c15
SHA1 038bc12e191c3e021248781077382d6fe9995df4
SHA512 f89ed92003587052f6101a08622876c38bdb1f8fa12b25a1c4cbfc8228e5a589d914362572c744b33aea1b1b3c92547d2d0990ad694efb84c44726dde84ff205
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
hisensetech.ml
Port
587
Username
[email protected]
Password
7213575aceACE@#$

Targets

- Target
  174579a122e1afba0000181b4ea93c15
- Size 928KB
- SHA256 cb8a7d1d9c86d996899769e9abac0b326053dae7f9d8fc226aabfa89f3f8d16e
- MD5 174579a122e1afba0000181b4ea93c15
- SHA1 038bc12e191c3e021248781077382d6fe9995df4
- SHA512 f89ed92003587052f6101a08622876c38bdb1f8fa12b25a1c4cbfc8228e5a589d914362572c744b33aea1b1b3c92547d2d0990ad694efb84c44726dde84ff205
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Drops file in Drivers directory

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2