agenttesla

General

Target

aecd152282def027bfd51b70b018af2c80dabf50c52ba4100c71c1047fe027dd
Size

853KB
Sample

221204-tlll8sdh85
MD5

eb8d5d4beb9857ebd4a263bddb055f8f
SHA1

d83417253e03fdc19479f95977f1fe66346729ff
SHA256

aecd152282def027bfd51b70b018af2c80dabf50c52ba4100c71c1047fe027dd
SHA512

acb015bbc4e24bcf298de1ebdbe280abb82d1ba7262e9dcf6a510feebbd4b35c61a5869fbe33419591ed595f1a727f36d75366e3977bf80fb47df660c3af99bb
SSDEEP

24576:ufJP8wnqWRaJr8Fs+AFIU6I+rdux0PRatqsc+gs80sgmFwkI8Fr:2+BJr82FI3jpuapaNczEsgmFIYr

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.kpce-co.com
Port:
587
Username:
[email protected]
Password:
l9#Qg$:nwmC3

Targets

- Target
  
  JTC20-PO074.075.exe
- Size
  
  1.2MB
- MD5
  
  5ca041632c9d92d36de6bbf016307719
- SHA1
  
  e4fb1871b21fdfa9beab676cd58a70f551930f7e
- SHA256
  
  164194c08dd53211cac7f964486f2dfbd9c1c8b4ccf980288d043f3544c7637e
- SHA512
  
  cadff82f9bdd33e721ac58172225c90d9d9d3dea50183e618d13286a0167ca3a8460f9a332fd73acd9051fa4d3750537fe4e7d70758094219e96695addac86e2
- SSDEEP
  
  24576:gQAnPK73wqJrGFem41Ic60+rVIx0JFCt8sc+WsU+sgGV+kICJrRy:ZwqJrGY1Ifv5IazCncVosgGVmId
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2