agenttesla

General

Target

6e1922de13813ce98705eb339e26b04f42b2e547edb7434109cae61b9260d4b7
Size

708KB
Sample

220520-3e253sbgak
MD5

c32e098f849d8bb4f5d514381594d69f
SHA1

ed07d71a8dfacc63482f0c45d5d05ee3718e9a31
SHA256

6e1922de13813ce98705eb339e26b04f42b2e547edb7434109cae61b9260d4b7
SHA512

be4dd358053e02ed6bb85390af8080c550e2f7ebca672c1402335ffd7ab84fd5c625cc265f976955e88fabad35677aa9f4e016dc4859b5c97f14836a85875e49

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.waltartosto.com
Port:
587
Username:
[email protected]
Password:
pZQhjl!9

Targets

- Target
  
  dhl_doc7348255141.exe
- Size
  
  900KB
- MD5
  
  643f996e34f83f00954663f0f9f15b39
- SHA1
  
  34f9447e70ca70d5d1dfc24ea5e310d9012e70aa
- SHA256
  
  5f424b8c80f27423b12cdf9d7d6a70937edb28fe07b8ed4dde0e965810cbd674
- SHA512
  
  67e55e50e0980336dc3745df76dad53d040b5b30eed48b0ea760077b991a9f5127df95c61d1a1424a0c613ac752ae20614983aacabd0848ccbb909108d0e9338
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2