agenttesla

General

Target
FOLLOW UP PAYMENT.zip
Size 475KB
Sample220722-hjl97sdcf3
SHA256 e6b02b928df9d97c74da7d2db792fdc1dc06f65b5c3ea179171391f870ec6cf0
MD5 64cf9bcb46e2a859c8370fd6411db821
SHA1 dffef5a4141f785905ce6ad5b3b4c1b2a7b611eb
SHA512 e80ae8aae4ba7ed827eaf2fe6fdafa86ffba1d25cbbf14183ae78b8157aee00f3ac58741205b4240f79eb741f6aee6cf4ef296d3391d1e29cc3c151c190f73a5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5357159221:AAEuOoQ0pUc4ccIZou0EJ5Zin0mMneE2jYg/sendDocument

Targets

- Target
  FOLLOW UP PAYMENT.exe
- Size 577KB
- SHA256 44ac93233199a7bc7e6f17be959844e6448f4e612f7f71909f2dfd41c3b388a7
- MD5 9616ca400b972668c6642ebf632b3fa3
- SHA1 88530fc14e1f7cb7600258dff9e9980f9e952df3
- SHA512 279d7a1b2714f2906f3872120f626949fb0c022a32610c841dee09741b762084864ac44f84a00b70c0e0ecdb24396ffab44aa4006da95e678f93585ac0d56543
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in Drivers directory

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2