agenttesla

General

Target
Bank FAB_ Payment Copy_Pdf.exe
Size 24KB
Sample220731-mtys7scdb3
SHA256 a1fed7db18fce4660f726771cd022f72270b92be51b27dd7279b3e4faf4d37e2
MD5 c8fd559242eab57fe48952b0feb1bf2a
SHA1 c2af8c2303c9d8bb23d31a996fc9732e1d37975e
SHA512 b012d9d99b3d558b6eb22e7fdc0b154e28bf7c9bc78b952ca418fbc3c77446d1f907388294eedc1e32e3b28965207b662dd9204f4bcb7c584dbd14260e98d674
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.barqaab.com
Port
587
Username
[email protected]
Password
Great@999@
Email to
[email protected]

Targets

- Target
  Bank FAB_ Payment Copy_Pdf.exe
- Size 24KB
- SHA256 a1fed7db18fce4660f726771cd022f72270b92be51b27dd7279b3e4faf4d37e2
- MD5 c8fd559242eab57fe48952b0feb1bf2a
- SHA1 c2af8c2303c9d8bb23d31a996fc9732e1d37975e
- SHA512 b012d9d99b3d558b6eb22e7fdc0b154e28bf7c9bc78b952ca418fbc3c77446d1f907388294eedc1e32e3b28965207b662dd9204f4bcb7c584dbd14260e98d674
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2