agenttesla

General

Target
Recibo de la transacción.PDF.exe
Size 124KB
Sample220504-pc6htsgddm
SHA256 4c9059aa76dfa2f817a4bf9cbf18e9f36d9235b6d6eb91af99c99eb68109afe5
MD5 73bc280b545daa847559f2a55e162f42
SHA1 271d6fc9494e9581d28f1657324deda94da0bbd7
SHA512 401e5fd34d8b776e281f1e167de9b3e1c367d7016f2cf6f8ffa447d3adc8da2bee11a5f0552edcecf11c92711bcd2dee865c936f260d9fd659cf7a078774a7fb
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5352056425:AAGLhl5XHl4SowyUsTAMmyTAeDJxhGWD9io/sendDocument

Targets

- Target
  Recibo de la transacción.PDF.exe
- Size 124KB
- SHA256 4c9059aa76dfa2f817a4bf9cbf18e9f36d9235b6d6eb91af99c99eb68109afe5
- MD5 73bc280b545daa847559f2a55e162f42
- SHA1 271d6fc9494e9581d28f1657324deda94da0bbd7
- SHA512 401e5fd34d8b776e281f1e167de9b3e1c367d7016f2cf6f8ffa447d3adc8da2bee11a5f0552edcecf11c92711bcd2dee865c936f260d9fd659cf7a078774a7fb
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2