agenttesla

General

Target
P-O 56783.exe
Size 42KB
Sample220209-matp5sabar
SHA256 23b769e1449f47cb7eebacc0381f9f3c2ecd7df18e77a4e8c3ef384dda10fb44
MD5 92c9395f8cd1b3e557130cb0334fe8d1
SHA1 ac71acd4f3afa22b5856ce1abdbb82a1f2e21b6a
SHA512 a7b069a45528f0aaa3d522d70fea7c9fedf2589631440b8204d56240a82d020057822813acac02f4b465f7c7b7a418712107987c6ba2bf789b60c18fe68af7ef
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.mgcpakistan.com/
Port
21
Username
[email protected]
Password
boygirl123456

Targets

- Target
  P-O 56783.exe
- Size 42KB
- SHA256 23b769e1449f47cb7eebacc0381f9f3c2ecd7df18e77a4e8c3ef384dda10fb44
- MD5 92c9395f8cd1b3e557130cb0334fe8d1
- SHA1 ac71acd4f3afa22b5856ce1abdbb82a1f2e21b6a
- SHA512 a7b069a45528f0aaa3d522d70fea7c9fedf2589631440b8204d56240a82d020057822813acac02f4b465f7c7b7a418712107987c6ba2bf789b60c18fe68af7ef
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2