agenttesla | dc72c7525da8aa1afaadaf707499054dd9be20d0c78318d2f63af1fa37d58546 | Triage

Sharing

General

Target

BL-SHIPPING DOCUMENTS.exe
Size

478KB
Sample

221129-xm2xdsfg39
MD5

69fe54a9cafee09f25e0d3f7a51488c7
SHA1

747373a2640c7fca04258681c7ec313be3b0db24
SHA256

dc72c7525da8aa1afaadaf707499054dd9be20d0c78318d2f63af1fa37d58546
SHA512

4230111e1b90da8e5d628bcfd16f9381cb24e9c0e31d3772798ea5bf78c711bc2634bf0343f323d094f23f587b6be5fd41f7828323d09f8a3ce0506c65a50706
SSDEEP

12288:0ZYJmqS//u3ML7l++F7oNt6YkIwaD2YSHTK:0Sg43ML7cEs8VaYTK

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5515611206:AAEcQSX8hXHOAxSYr8KUdLxGF5eqw4FRXoA/

Targets

- Target
  
  BL-SHIPPING DOCUMENTS.exe
- Size
  
  478KB
- MD5
  
  69fe54a9cafee09f25e0d3f7a51488c7
- SHA1
  
  747373a2640c7fca04258681c7ec313be3b0db24
- SHA256
  
  dc72c7525da8aa1afaadaf707499054dd9be20d0c78318d2f63af1fa37d58546
- SHA512
  
  4230111e1b90da8e5d628bcfd16f9381cb24e9c0e31d3772798ea5bf78c711bc2634bf0343f323d094f23f587b6be5fd41f7828323d09f8a3ce0506c65a50706
- SSDEEP
  
  12288:0ZYJmqS//u3ML7l++F7oNt6YkIwaD2YSHTK:0Sg43ML7cEs8VaYTK
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Sets service image path in registry
  persistence
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan