agenttesla | 461c842fe489a6cdb051283e103f21acd55f04d2b6ed2a16144b518c63f9cedb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Win32.PWSX-gen.26566.exe
Size

242KB
Sample

220913-xlck4scbhj
MD5

428a8a94c4111812c6bc44d31d1b8009
SHA1

b81d472fca076e2d4a50d9b821a9401a6fb6c369
SHA256

461c842fe489a6cdb051283e103f21acd55f04d2b6ed2a16144b518c63f9cedb
SHA512

ab88e2f2dac7337a9b4733b1c76e6c73a8bacc245b3c5cf09ce3540c3013fea8e6b553c23ec0a71123e729aae5698eb6ddfe0391b0baf39187259178195351b8
SSDEEP

6144:QML1ZWOvUbibLmENeXT5kPEqkj3uN7kpJqPUtpG:QM5ZWOvU4LkXTsnK3uhkp4PUt0

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
%2B
Port:
21
Username:
application/x-www-form-urlencoded
Password:
image/jpg

C2

p=

Targets

- Target
  
  SecuriteInfo.com.Win32.PWSX-gen.26566.exe
- Size
  
  242KB
- MD5
  
  428a8a94c4111812c6bc44d31d1b8009
- SHA1
  
  b81d472fca076e2d4a50d9b821a9401a6fb6c369
- SHA256
  
  461c842fe489a6cdb051283e103f21acd55f04d2b6ed2a16144b518c63f9cedb
- SHA512
  
  ab88e2f2dac7337a9b4733b1c76e6c73a8bacc245b3c5cf09ce3540c3013fea8e6b553c23ec0a71123e729aae5698eb6ddfe0391b0baf39187259178195351b8
- SSDEEP
  
  6144:QML1ZWOvUbibLmENeXT5kPEqkj3uN7kpJqPUtpG:QM5ZWOvU4LkXTsnK3uhkp4PUt0
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan