agenttesla

General

Target

8F4D17B42A367196C6444DA4E28B6B1892910C88FC2D2B08866D22EE3CD8DCC2
Size

1.3MB
Sample

221123-r1mrqsch9z
MD5

efb3fec822d7466be33f053ce370c303
SHA1

0749e77702d23f729591b5accfbbf326c84f173b
SHA256

8f4d17b42a367196c6444da4e28b6b1892910c88fc2d2b08866d22ee3cd8dcc2
SHA512

921aec7793dc366d645b07f2eadb1da7dde66ec80276a07833e7a3c63030afeca2bce8204b2942e55a1be9480712cec6c38ce9969a7ccfc091780dd71cc4159b
SSDEEP

24576:67gm+L74mBfNUstzorFy4OaqtHKAyYFkVRFwHvQ5ywqp:6sWFBgIyH45yT

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.citroenbn.cz
Port:
587
Username:
[email protected]
Password:
xSara2019
Email To:
[email protected]

Targets

- Target
  
  NEW_ORDE.EXE
- Size
  
  804KB
- MD5
  
  c1a1c5d3e6d5814a30314822c7ccda0d
- SHA1
  
  9254c500a0be23c876ab8ca9f1c644600df0bb47
- SHA256
  
  913f5087a80d070cbfe31df2c4fa50236b663b13d29c33d3b4f59073da4aa80d
- SHA512
  
  d740a2c2c7af28c571744236043980e93ff0892cc50874e62ab27c4844f2ae0792c76df284b1e3590fe424dace79047ccce82f4e45277c7f2e9d112cf42ae50e
- SSDEEP
  
  24576:P7gm+L74mBfNUstzorFy4OaqtHKAyYFkVRFwHvQ5ywqp:PsWFBgIyH45yT
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2