agenttesla

General

Target
24f92a7026c840f4a49363015754f58b.exe
Size 423KB
Sample220331-leqzdahfe8
SHA256 e654eb888cf345f65b8363a808a86111d1c0bfeee51a78b0d0c756a7f3bd4c0c
MD5 24f92a7026c840f4a49363015754f58b
SHA1 5c0b7d1c758cdfddcec810c429e98be0d01c2980
SHA512 03d1f001ebf907576346f8207823cd283920ff24b804ed65c4437eb22d1bf1adf88a3f6ff360ef30bc6fea68a3b23bceb0d8bb13d097f3202d7f991e72ae51ac
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  24f92a7026c840f4a49363015754f58b.exe
- Size 423KB
- SHA256 e654eb888cf345f65b8363a808a86111d1c0bfeee51a78b0d0c756a7f3bd4c0c
- MD5 24f92a7026c840f4a49363015754f58b
- SHA1 5c0b7d1c758cdfddcec810c429e98be0d01c2980
- SHA512 03d1f001ebf907576346f8207823cd283920ff24b804ed65c4437eb22d1bf1adf88a3f6ff360ef30bc6fea68a3b23bceb0d8bb13d097f3202d7f991e72ae51ac
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

AgentTesla Payload

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2