agenttesla | dea83962ad83dc776c8d2811e0eb6f5677b94561289c0e7383f427f27a42ee9f | Triage

Sharing

General

Target

fb21438e0fd436b1870238ff0d4f66ee
Size

583KB
Sample

221004-x1mpmaccgl
MD5

fb21438e0fd436b1870238ff0d4f66ee
SHA1

dcb041f3ff8308105beb8174e6693570898b9734
SHA256

dea83962ad83dc776c8d2811e0eb6f5677b94561289c0e7383f427f27a42ee9f
SHA512

a44b47818360de32f999c4a7c536da951487b777ffd165786d81704617df38f466851cb4295bbe9852094ac5c321b5f013f6f925150e7e95e3bd690baf6f8a2f
SSDEEP

12288:721RfDoXDLFkdOwwSxJIuuzepyAlLfz0a2f7/Z:q1R+/ZEJI97AlLf+ft

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
multimetals.cfd
Port:
587
Username:
[email protected]
Password:
[email protected]

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
multimetals.cfd
Port:
587
Username:
application/x-www-form-urlencoded
Password:
[email protected]
Email To:
[email protected]

Targets

- Target
  
  FACTURE PROFORMA GIZ DU 30 AU-2022-OCWAR-T.exe
- Size
  
  637KB
- MD5
  
  9ab99c48c4658a5cb43e0227a55de1ad
- SHA1
  
  21804052a09be6483076ab81d17ff2a2042de2eb
- SHA256
  
  af15b91627b0f831d00118eaffd1ffc737b38a703c4045d436859d2bbafb9d63
- SHA512
  
  56eef80ad582c16fe88d101265a7add37232496950b2316829e17ba9d5526180826b50cf5894e2c9aa970b767e545c50bf1494bd529177ee8dec6883b2fa82c3
- SSDEEP
  
  12288:6fDlBgQeAnkclIfVfhc71I1W6cYcl9v4QjFMsZNSs86D6d:MDwQeAnN+R1W6cP7JjFMsZN26D6d
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2