agenttesla

General

Target
SecuriteInfo.com.Trojan.DownloaderNET.375.8931.18470
Size 21KB
Sample220505-t1cymsbafp
SHA256 37e3a3e4a0b161fbfd16602bb993ceeb34a7f25f2fc6d36459cc35afbff92363
MD5 39e1cf2850b27d2682bbe4bf0201ee9a
SHA1 d42623521871430fff894acc667bbb1b5f657375
SHA512 d7d7745039930e1b8260efa7350e106632dbf5953d2999dd82a312993efbfb7161fa28ad047d19a6ec283751011e40b73f932d0269f8e0e3716e39dff64a39ed
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5250591642:AAFCsHC68T8VP-UXonoTnVp9mgZl_BSn8kw/sendDocument

Targets

- Target
  SecuriteInfo.com.Trojan.DownloaderNET.375.8931.18470
- Size 21KB
- SHA256 37e3a3e4a0b161fbfd16602bb993ceeb34a7f25f2fc6d36459cc35afbff92363
- MD5 39e1cf2850b27d2682bbe4bf0201ee9a
- SHA1 d42623521871430fff894acc667bbb1b5f657375
- SHA512 d7d7745039930e1b8260efa7350e106632dbf5953d2999dd82a312993efbfb7161fa28ad047d19a6ec283751011e40b73f932d0269f8e0e3716e39dff64a39ed
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2