agenttesla

General

Target

0c38b5488a2c72a89b8bbcf9114d94578acb14b442ffa2d5715e5da9ba2a4be6
Size

1.1MB
Sample

221020-zhb7aadgbl
MD5

90a2ccda517e62a31ce6957386216067
SHA1

82a0ef5278084fc710269c23c1a88ddf10d34fac
SHA256

c74ec108cb5e8f59d4565503756078f8652b8b99f43fc00bc412082ae2d63d57
SHA512

19ef57d8e1b77807bb9469745f1ad2d9045e3dfd206800235e3c678674d99afc4c2d46ec381251f0175c291958bed69290c7b9bdcb3166606663ed8a36bb671c
SSDEEP

24576:uP0faIpxOOWIjggMV1wfcsQU8xp0/TApHAgK5dcbKQSA:uPC/gOugMVWfcXU8xpacpTK5WKQSA

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.botswlogistics.com
Port:
587
Username:
[email protected]
Password:
*(QSTCj8

Targets

- Target
  
  0c38b5488a2c72a89b8bbcf9114d94578acb14b442ffa2d5715e5da9ba2a4be6
- Size
  
  1.2MB
- MD5
  
  d881b25107c15e6a403533b2fded497f
- SHA1
  
  157a39b6cc0bf291ae562de3375ef1b6ecfde68f
- SHA256
  
  0c38b5488a2c72a89b8bbcf9114d94578acb14b442ffa2d5715e5da9ba2a4be6
- SHA512
  
  85acea38a31c7f7afd44ae410f1b5192ca4b2fb82242bdf83019e415d8ee51f8609ecf386689c62646eb853fb5827edb48d37607a1ed679970b0b826ea975b52
- SSDEEP
  
  24576:gAOcZXQOsoYKjqsM3RwfksQU8OIgibj5HHeg/cbGOSMIKB4p:+boisM3afkXU8H335HdYGOSMji
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2