agenttesla

General

Target

45039a98fc24a27ed3f1542f0ab781206b5dd69ed8378a84f18c380f20554451
Size

453KB
Sample

220521-axrg3sahg4
MD5

d74c0ea5282db3775165967298b51fe2
SHA1

e37434077f86afbe8893a90e901ec6578f4f3368
SHA256

45039a98fc24a27ed3f1542f0ab781206b5dd69ed8378a84f18c380f20554451
SHA512

f75ab86ad57c3db6eca71d8e92248afaee7aed8a551a8fa95e025d49a80f17f5a7f80ae26d05b471ec075586bc1ae9ab25cad8947059fa8537fc7dd6a6214303

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.anantcreation.co.in
Port:
587
Username:
[email protected]
Password:
RUC&!^%*29

Targets

- Target
  
  IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.exe
- Size
  
  720KB
- MD5
  
  cb11ecf7241a48ebe88b231b933255b0
- SHA1
  
  f0bd3c7a22d481f8b63125e004b8af748140356d
- SHA256
  
  9712dff3b6fa45fc67392d63381d89f975fa09cf553d8ed69bad81cd61b8ff65
- SHA512
  
  5a974c8590db15d5c6bb84c8fc66e8762c48cfb0d451af0895a6478fbc53bee7b8315956a615356df178f0e7f8311de30f7868f0c2fd5be05459b8f08736a005
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2