agenttesla | 704c8c0960f492c87928d15659a3e16df0c76591d0abaa83a011c58d4fd98ae2 | Triage

Submit
Reports

Overview

overview

Static

static

DHL Online...pt.exe

windows7_x64

DHL Online...pt.exe

windows10_x64

Sharing

General

Target

DHL Online Receipt.exe
Size

501KB
Sample

211021-mbcs1sabe7
MD5

b265fa5c20dcb7fc8a7c715f5194edcf
SHA1

c6e34ec56347f92353148f221b36e06b99b173b9
SHA256

704c8c0960f492c87928d15659a3e16df0c76591d0abaa83a011c58d4fd98ae2
SHA512

9351234939bad33f778cc54cfb848ea2cb6a6795ad671e7aa3bd0d39c3ab7a125c0ddc63404635b83a3a4515cc0a1ea655c2f1579eda7c9aa4dfde88ad1df255

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

DHL Online Receipt.exe

Resource

win7-en-20210920

agenttesla collection keylogger persistence spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

DHL Online Receipt.exe

Resource

win10-en-20211014

agenttesla collection keylogger persistence spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
sandra.hurm@voestallpine.com
Password:
project2021blessing

Targets

- Target
  
  DHL Online Receipt.exe
- Size
  
  501KB
- MD5
  
  b265fa5c20dcb7fc8a7c715f5194edcf
- SHA1
  
  c6e34ec56347f92353148f221b36e06b99b173b9
- SHA256
  
  704c8c0960f492c87928d15659a3e16df0c76591d0abaa83a011c58d4fd98ae2
- SHA512
  
  9351234939bad33f778cc54cfb848ea2cb6a6795ad671e7aa3bd0d39c3ab7a125c0ddc63404635b83a3a4515cc0a1ea655c2f1579eda7c9aa4dfde88ad1df255
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy