agenttesla

General

Target

f93a549b02a7e5e2c69447f9e80be87dcee4d4768b6c857438a244d67069669d
Size

271KB
Sample

220521-pq7m2sbafq
MD5

d06805215fb9d61ec7f0cd79e5914955
SHA1

b80530a0c2d41db93565eb11c917fbcdb1f69c0b
SHA256

f93a549b02a7e5e2c69447f9e80be87dcee4d4768b6c857438a244d67069669d
SHA512

780ebd89fda47cab3597d0e4c3fd4355f3d086e89c4f6454b358964be5d5a63c446ee6f2d77731f8d98ebcb9d87a1293c2aaf4fb6df6b7b772e83136a4d4d498

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.flood-protection.org
Port:
587
Username:
sepp@flood-protection.org
Password:
sepp2424@

Targets

- Target
  
  Document Copy.exe
- Size
  
  651KB
- MD5
  
  056779505e918821f7c8eea853a3aede
- SHA1
  
  50547be0f9807212ad045cbde8b95ead9abc56bd
- SHA256
  
  0d2a1e1ae63f88fe43639ddcec25db83eef70cc09ed98403f570fb61293fcf2f
- SHA512
  
  e6dab6cb7942936ce04952261853d89a3c5eb657035d015221456292fa29330a98d27c76a5faf1069101acc9e545e2f375258ef0325e83b25e061b41d7afd9fc
Score

10^/10

agenttesla agilenet collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Obfuscated with Agile.Net obfuscator

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2