agenttesla

General

Target
a86fcdc35c25da4812cd08fbf2e30469
Size 617KB
Sample220615-x4yajaedc8
SHA256 4119daf209813f03da5dac84667bfeb45f2eeef85f647f621ab08ef5b1ac4bce
MD5 a86fcdc35c25da4812cd08fbf2e30469
SHA1 76be5b9f09edac706ad5aee8d71d0901583b4f59
SHA512 cb46c835217a2149fa6fc8ae19854f827d3609233e04e8c2203ddd7b8c3492c80369cf844a8087b8a8daa69672f499eec5f8058bc5589804e6f1c6086b9d7c3b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.boyyem.com.tr
Port
587
Username
[email protected]
Password
Muhasebe4442319
Email to
[email protected]

Extracted

Credentials

Protocol
smtp
Host
mail.boyyem.com.tr
Port
587
Username
[email protected]
Password
Muhasebe4442319

Targets

- Target
  a86fcdc35c25da4812cd08fbf2e30469
- Size 617KB
- SHA256 4119daf209813f03da5dac84667bfeb45f2eeef85f647f621ab08ef5b1ac4bce
- MD5 a86fcdc35c25da4812cd08fbf2e30469
- SHA1 76be5b9f09edac706ad5aee8d71d0901583b4f59
- SHA512 cb46c835217a2149fa6fc8ae19854f827d3609233e04e8c2203ddd7b8c3492c80369cf844a8087b8a8daa69672f499eec5f8058bc5589804e6f1c6086b9d7c3b
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2