agenttesla

General

Target
DHL AWB8114704877888.exe
Size 805KB
Sample220211-lw87aacea8
SHA256 777ab54efae3ebf08dd94823c2bd4fbd6c8e063dad74d4f3eb4a5a32cb1ba6d0
MD5 298b85d56eaf81750a59c3c1da21b0e4
SHA1 d2e42245f31a6d840397d6b1ea4d9d2bb93a196a
SHA512 31033294db0af72616275c3ad33c53315e15466afba3240d89388b7a381153acb33208520fe8da3bf8303b6eda27fce08fb4a2ec8e1530d2910874d759b3db68
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument

Targets

- Target
  DHL AWB8114704877888.exe
- Size 805KB
- SHA256 777ab54efae3ebf08dd94823c2bd4fbd6c8e063dad74d4f3eb4a5a32cb1ba6d0
- MD5 298b85d56eaf81750a59c3c1da21b0e4
- SHA1 d2e42245f31a6d840397d6b1ea4d9d2bb93a196a
- SHA512 31033294db0af72616275c3ad33c53315e15466afba3240d89388b7a381153acb33208520fe8da3bf8303b6eda27fce08fb4a2ec8e1530d2910874d759b3db68
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2