agenttesla

General

Target

d18a20bdc5f8ec858c63521d95178db316e5af73ca2620dc01132955ef0c9a85
Size

384KB
Sample

220521-bz6v8acgd9
MD5

096034f6080fdf965c6dbe909370fd7e
SHA1

395ebe0feae9b7d5c835186de665c2788fee01db
SHA256

d18a20bdc5f8ec858c63521d95178db316e5af73ca2620dc01132955ef0c9a85
SHA512

3a8fd6328f34ef94bf25b123d4a7e6e4b4510eb985c3fd96f9d81d5779a78e6519a0cf36646d62ad1656ca8752da47cd798097d0bfc112f8646e7db3fb554d4e

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Lion@4321

Targets

- Target
  
  MV ZHONG HUA MEN V1906 CALLING TO DISCHAGENT APPOINTMENT.exe
- Size
  
  520KB
- MD5
  
  b95987d3d3d9cc6bfbc5a06d46409817
- SHA1
  
  d36543e8a6da34a9f92c7a1488f2e22774750cc3
- SHA256
  
  935ed6ae88a824109924582a1b854e983b641d6912816a79f48a0c07ccb4ffc0
- SHA512
  
  1055eeb90c9c912101e6a39258f8786d2e0899832f10684ec3c04d4adadd4152f76dceef6cc886ce35c6006c73ab84e87caf6d0b1346383fdac480f630cf5d44
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2