agenttesla | 803673bbf320af5f6b2da37e9e755d4cfe4e0490bdb042e4957c7ebb067da2fb | Triage

Sharing

General

Target

803673bbf320af5f6b2da37e9e755d4cfe4e0490bdb042e4957c7ebb067da2fb
Size

373KB
Sample

220521-b1vvcacgg8
MD5

fcc78a7db961d6043b30372921b24505
SHA1

b1ddf0e1c4fcba576725b3225836fc9280f044a4
SHA256

803673bbf320af5f6b2da37e9e755d4cfe4e0490bdb042e4957c7ebb067da2fb
SHA512

15453473c8bdb870b2b41b5943c36a09ba39e710eac5c1d28c23509aafc4f688e528a310ce6a720f83fa20e63c1f7929a1e777c7b24ed77700010d70f6e566b8

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.okgrocer.co.za
Port:
587
Username:
[email protected]
Password:
Theunis@123

Targets

- Target
  
  GFR Striff GmbH Quote Request.exe
- Size
  
  553KB
- MD5
  
  a2696acada8560e12f34664bd720decc
- SHA1
  
  90fba0988d19126be5f1f6ed2babe4d0f04986ef
- SHA256
  
  11aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
- SHA512
  
  66d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2