agenttesla

General

Target

c7b132c35958d7b0ff59028437c6f7e77f21754ddc08528bbada3124d67d676e
Size

267KB
Sample

220520-3eaqtsggb5
MD5

5c851bb24b9a384fb59afc1e817b11fa
SHA1

7aa58c5f7ebc6a557d83042d2dc559058ab4f61b
SHA256

c7b132c35958d7b0ff59028437c6f7e77f21754ddc08528bbada3124d67d676e
SHA512

ab20ce109034f4b5f6334ad767ec2b43c07e5511c8fc143744cf08068ac9dc54cd4915e17950eecf015d735da331f98c3474841c20c0831cd6a72c2c8ce423e4

Score

10^/10

Malware Config

Targets

- Target
  
  PRODUCTS ENQUIRY.exe
- Size
  
  653KB
- MD5
  
  6f6f4390aef55769f57b875d69d44291
- SHA1
  
  f908b0c767f92fd729b063ffc84d9daec62f451e
- SHA256
  
  5a66e9b96a8cfabbd1e6f0fc4791c5d0a9cc6a9b0e09acb4a0fe284b89912537
- SHA512
  
  a4e75d73c69c3480ef6b1d138c6838796075ebae8d8c757ba6699275b6a2efc863c6822ea0c84dca7ffaa9d580d130a20d8e42289411fb39a7bf2647ae45b169
Score

10^/10

agenttesla agilenet collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Targets

AgentTesla Payload

Executes dropped EXE

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2