agenttesla

General

Target
83d3cc4cbe3d794077935091dd403a38.exe
Size 867KB
Sample210824-j8xmsdlv92
SHA256 fa88c9d7dcfac75ae440673f335e4da8faba4c9fe4d500ae5de053425e69910e
MD5 83d3cc4cbe3d794077935091dd403a38
SHA1 d8fa6120afca65102358ec2756b621a5c516e7e4
SHA512 e42e8a591cfe12731bbc5d075b683857b0613610e79693f5ef00088deedf839791cd7be3293ab06fe3302a1b2cb81592c91da4b0f063847bd3f73ed98d16ed76
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
bh-16.webhostbox.net
Port
587
Username
[email protected]
Password
7213575aceACE@#$

Targets

- Target
  83d3cc4cbe3d794077935091dd403a38.exe
- Size 867KB
- SHA256 fa88c9d7dcfac75ae440673f335e4da8faba4c9fe4d500ae5de053425e69910e
- MD5 83d3cc4cbe3d794077935091dd403a38
- SHA1 d8fa6120afca65102358ec2756b621a5c516e7e4
- SHA512 e42e8a591cfe12731bbc5d075b683857b0613610e79693f5ef00088deedf839791cd7be3293ab06fe3302a1b2cb81592c91da4b0f063847bd3f73ed98d16ed76
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Drops file in Drivers directory

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2