agenttesla

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.31336.13146
Size 18KB
Sample220606-yenv8sbcb4
SHA256 4a8e5d6a409a60db11f4fc5599d5ff0fb0b4fafcadddbb1281d74ee85ddd1068
MD5 4c91d98ebb248db3069105605e53ad08
SHA1 d38d6b6e9c74c62de859cbd30208708bd59d0b0a
SHA512 fd5d472511c24f294482687895835212a5182f86861d3b6995bf655db9b023b6869ad2ad3e67c8a039dfc709d69c6cad4640427c749e40f4010e5655f2735f50
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5387517837:AAHI8L3I-OHmq0oJo6tuPuoRyKMJax0PL9I/sendDocument

Targets

- Target
  SecuriteInfo.com.W32.AIDetectNet.01.31336.13146
- Size 18KB
- SHA256 4a8e5d6a409a60db11f4fc5599d5ff0fb0b4fafcadddbb1281d74ee85ddd1068
- MD5 4c91d98ebb248db3069105605e53ad08
- SHA1 d38d6b6e9c74c62de859cbd30208708bd59d0b0a
- SHA512 fd5d472511c24f294482687895835212a5182f86861d3b6995bf655db9b023b6869ad2ad3e67c8a039dfc709d69c6cad4640427c749e40f4010e5655f2735f50
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2