agenttesla

General

Target

1f65234972caf1269377020b12bfae0400c406da1ace65f81fdae261f3139f23
Size

484KB
Sample

220520-2mj4ssafep
MD5

e324cd37cc6597f71bc9e904ac492132
SHA1

78ade741504260ecb1d52a651ce28b6b5f7c0f67
SHA256

1f65234972caf1269377020b12bfae0400c406da1ace65f81fdae261f3139f23
SHA512

dc3a6001bf3e4d3abf47096fa016461075a3037d0fa8404e89b2b3215b56bddc2c53ff0be1ead2c9df5e5c6dbf0346fea6853c6e82ea7a99491d43c789908052

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mlibano.com.br
Port:
587
Username:
[email protected]
Password:
libano@2017

Targets

- Target
  
  Αντίγραφο απόδειξης 08.31.2020.exe
- Size
  
  517KB
- MD5
  
  bfd777e5010d93c1dcd73bf3113cf40f
- SHA1
  
  82cb91a0d24069b46f4d6cef70bb8dccecd97e1f
- SHA256
  
  ae4f4655a1ce9b6f4e9248e6b349d1f5028c20fbdf92b1ca2d824338444e66b0
- SHA512
  
  7cbfd1a62a99c0f33a6d7d3906e035a482b0dfc8a449a4e4ce928c33ce3f12bd4ec3e71ae6ec1d5a89ce232413f931c1eacf395c515d570ed510ce82a23a3b96
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2