agenttesla

General

Target

offer Order And Shipping Details.exe
Size

973KB
Sample

211014-qcntfsheh6
MD5

e541ccd346efda9a73ca77705c0f593b
SHA1

e7b586668604ad4db47455bf0fff086aeb0cad60
SHA256

336c8f08437e02813b6f5c4a9e61f6b22f93fb28b014532dfe48b5a1707f6cce
SHA512

a93b96a24188a2644e48df906f4e9780eb22bc13ecab7722dfb50a8a1c47ace547b34fd8ff1388c7dff99f1675c434da434c22c90ae5fcc90d37d59d0adf9134

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.thts.vn
Port:
587
Username:
[email protected]
Password:
123luongngan1989

Targets

- Target
  
  offer Order And Shipping Details.exe
- Size
  
  973KB
- MD5
  
  e541ccd346efda9a73ca77705c0f593b
- SHA1
  
  e7b586668604ad4db47455bf0fff086aeb0cad60
- SHA256
  
  336c8f08437e02813b6f5c4a9e61f6b22f93fb28b014532dfe48b5a1707f6cce
- SHA512
  
  a93b96a24188a2644e48df906f4e9780eb22bc13ecab7722dfb50a8a1c47ace547b34fd8ff1388c7dff99f1675c434da434c22c90ae5fcc90d37d59d0adf9134
Score

10^/10

agenttesla nanocore collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- AgentTesla Payload
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NanoCore

AgentTesla Payload

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2