agenttesla

General

Target
Quote order#098799.exe
Size 754KB
Sample220217-pg7xfsccfm
SHA256 63e9e2155d1e91db69ef70f561bb895db40b45d395960cca4ac467c4a454be4d
MD5 cb8af96125688a9948fadbb813084030
SHA1 99e2a2a8f37d155a9a5b1be1adc368c2d8ab7199
SHA512 10ca83bf5e774c2fff4610a2b3930f0f014190fd053542ff1c287d0e849a2de820f482aacb234f1e3237d38e45047b99241b18dc59b57bb3825d11c1ea10930f
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2092755520:AAFUT-2SMjjd39KTAiZYfccbaFzWXamzjz4/sendDocument

Targets

- Target
  Quote order#098799.exe
- Size 754KB
- SHA256 63e9e2155d1e91db69ef70f561bb895db40b45d395960cca4ac467c4a454be4d
- MD5 cb8af96125688a9948fadbb813084030
- SHA1 99e2a2a8f37d155a9a5b1be1adc368c2d8ab7199
- SHA512 10ca83bf5e774c2fff4610a2b3930f0f014190fd053542ff1c287d0e849a2de820f482aacb234f1e3237d38e45047b99241b18dc59b57bb3825d11c1ea10930f
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Drops file in Drivers directory

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2