agenttesla

General

Target
payment details.exe
Size 1.0MB
Sample220412-ct5awadecp
SHA256 3b3ff2afcf8f10b9221e2bd5a293652103782881a9721eb94b321e20cada320a
MD5 f6f3ec2234e8df802123c1db515e09ae
SHA1 760341747afba84109b41ddfa237bd94d6e6cec2
SHA512 0e987afe747c66324049b4542ad38c1d019090ec499e208486521c2209c0571cb38059e796fa3d8adc4e12582165a7898c78f0de8e70328a26648deded9117fb
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.morabitur.com
Port
587
Username
[email protected]
Password
ReservarEConfirmar

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.morabitur.com
Port
587
Username
[email protected]
Password
ReservarEConfirmar
Email to
[email protected]

Targets

- Target
  payment details.exe
- Size 1.0MB
- SHA256 3b3ff2afcf8f10b9221e2bd5a293652103782881a9721eb94b321e20cada320a
- MD5 f6f3ec2234e8df802123c1db515e09ae
- SHA1 760341747afba84109b41ddfa237bd94d6e6cec2
- SHA512 0e987afe747c66324049b4542ad38c1d019090ec499e208486521c2209c0571cb38059e796fa3d8adc4e12582165a7898c78f0de8e70328a26648deded9117fb
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger persistence spyware stealer suricata trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata: ET MALWARE AgentTesla Exfil Via SMTP
  suricata
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

suricata: ET MALWARE AgentTesla Exfil Via SMTP

Drops file in Drivers directory

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2