agenttesla

General

Target
PO NO. P0008005.exe
Size 8KB
Sample210817-c7rr51256x
SHA256 12a978875dc90e03cbb76d024222abfdc8296ed675fca2e17ca6447ce7bf0080
MD5 1e621a8a257d325510d24f67ce352123
SHA1 f32e0824226e0e9d387f56c3f05f3d64481005dd
SHA512 29a310a4d3cb27dedd7d2737e9585ae82b5b2cd647b15a62253e6ddcad9ea97a1170cb9f1a87042fdba351591f1c3a9aac6d2e9d4aef21d0b10a9bdfbebbde92
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.avatar.ps/
Port
21
Username
[email protected]
Password
tpe2zfF]j0Xc

Targets

- Target
  PO NO. P0008005.exe
- Size 8KB
- SHA256 12a978875dc90e03cbb76d024222abfdc8296ed675fca2e17ca6447ce7bf0080
- MD5 1e621a8a257d325510d24f67ce352123
- SHA1 f32e0824226e0e9d387f56c3f05f3d64481005dd
- SHA512 29a310a4d3cb27dedd7d2737e9585ae82b5b2cd647b15a62253e6ddcad9ea97a1170cb9f1a87042fdba351591f1c3a9aac6d2e9d4aef21d0b10a9bdfbebbde92
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Downloads MZ/PE file
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Downloads MZ/PE file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2