agenttesla

Resubmissions

20/12/2021, 18:58

211220-xmfn6acdgl10

20/12/2021, 17:39

20/12/2021, 11:47

20/12/2021, 11:10

15/08/2020, 06:09

Sharing

Copy URL Twitter E-mail

General

Target
RFQ ICT-200068-MKE-AL ESTISHARI_pdf.exe
Size 603KB
Sample211220-v8ctaabdc2
SHA256 3ac8a6bb8e3551f1889bcdbe567d78c4d1afd90f91904d5bbaffc6879abbb37a
MD5 23f551a5ac8ec744ece3dabee871cd30
SHA1 97227666e1b88f7f6e2d88e6d53c832edf6f52cb
SHA512 0f53a4efdc1159a96e177e288b0a7ca58bd4acd3ade45a5720d4633f514f824a42bba761859fd6a7c6f0da51f32c493fb7b1bf73526d28bf4574858d5bc4e25e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.specialmetal.ir
Port
587
Username
[email protected]
Password
02188985257

Targets

- Target
  RFQ ICT-200068-MKE-AL ESTISHARI_pdf.exe
- Size 603KB
- SHA256 3ac8a6bb8e3551f1889bcdbe567d78c4d1afd90f91904d5bbaffc6879abbb37a
- MD5 23f551a5ac8ec744ece3dabee871cd30
- SHA1 97227666e1b88f7f6e2d88e6d53c832edf6f52cb
- SHA512 0f53a4efdc1159a96e177e288b0a7ca58bd4acd3ade45a5720d4633f514f824a42bba761859fd6a7c6f0da51f32c493fb7b1bf73526d28bf4574858d5bc4e25e
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2