agenttesla

General

Target
Packing list.exe
Size 720KB
Sample220906-1v2hdaaec2
SHA256 7cffd8eb6866547d175295072b7f1b180467a29b537da3ede1f2c3ebe11c7aaf
MD5 664062762de8fdfb381268ae566f3d9e
SHA1 d9f2cbd717f700fe9046f947f62fa9d906b3d46f
SHA512 66dc66420565f1b4b2b34a6b5dff7c1dfda6ac9fb65a12738066d866abf8e91afc462d94d1f9c51d9b00bb6158819d69b17aa47787bfa98a5e93168174bb611a
SSDEEP 12288:TRbG5h7Tu3XDG2g9YIDz+gbldEevK1pisp2VDPrv/ugwyu4CkrOP7Vg:dG5d4G2UpZdEeC1pispaDDHugwv412h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5056459562:AAHQW9wJvHEkQsnxuML0xV3IDA6-DUuUNFI/sendDocument

Targets

- Target
  Packing list.exe
- Size 720KB
- SHA256 7cffd8eb6866547d175295072b7f1b180467a29b537da3ede1f2c3ebe11c7aaf
- MD5 664062762de8fdfb381268ae566f3d9e
- SHA1 d9f2cbd717f700fe9046f947f62fa9d906b3d46f
- SHA512 66dc66420565f1b4b2b34a6b5dff7c1dfda6ac9fb65a12738066d866abf8e91afc462d94d1f9c51d9b00bb6158819d69b17aa47787bfa98a5e93168174bb611a
- SSDEEP 12288:TRbG5h7Tu3XDG2g9YIDz+gbldEevK1pisp2VDPrv/ugwyu4CkrOP7Vg:dG5d4G2UpZdEeC1pispaDDHugwv412h
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

Drops file in Drivers directory

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2