agenttesla

General

Target

RFQ-033031-GCMGULF-SPS-19-10.zip
Size

445KB
Sample

211020-an2xfshddm
MD5

bb2950232f58c3f2b7495788e89c1bf3
SHA1

718bb28c7c25cd0901a562ce4795dc4429ea5f4e
SHA256

f0a483652457a70fbcf19a0a26d46fcad3d231cc855a21565f5fff0e7a5d8b61
SHA512

cd896827bb068ede84988b520f94e76a6bcc7b6765ecc7ddd7130cc82827ae6fdb2e653a7b5e8eaaf407d5a7824c24d00167411ceafc5ccf4169fe2b505c944c

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vinnyinteriors.com
Port:
587
Username:
[email protected]
Password:
koxZJ@I2

Targets

- Target
  
  RFQ-033031-GCMGULF-SPS-19-10.exe
- Size
  
  405KB
- MD5
  
  22c999f6b5f2c7d7bea5f03d0405197a
- SHA1
  
  9ceb02fbab7cb667edb6dbc71c43f1f839ab0291
- SHA256
  
  04d6c0b73528c0b03eb5f0df3ba4da8f3f111c38aaa721d590e1186e2b342b57
- SHA512
  
  3d8503242e2fbc576c25aa2b6a727253270bd0c9b6e268febfa5c399ca6376478e383223b536013e63ad065d08e3f836dd63b2083a9d8d1e53fb8d1e6b3c83c2
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  ZPicture-1- 2021-10-19 at 2.24.57 PM.jpeg
- Size
  
  72KB
- MD5
  
  3588fce20df35048424d65641c8142cf
- SHA1
  
  17adecd4dbbbc7029ee9fc19ab47e7585fab39e5
- SHA256
  
  7f3afc7117629cdcf612432295be5683c9f611a266acbfccb2eb1d7b75b0fb2d
- SHA512
  
  8542ef9c89eb694390e7633bd57fa64f8721f47a4d9de036d0282fdd72204c05b33145fe7563d1fca927569cd5e0a88bef555478f8d31e133e9e57eb7f32ccb1
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4