agenttesla

General

Target

1808-57-0x00000000050B0000-0x00000000050E8000-memory.dmp
Size

224KB
Sample

221205-tn781seh26
MD5

57a8d21d0dcaba33dfef947466604345
SHA1

b29d32c144d7bb197c3038cdd74315115d34c25f
SHA256

0a91dce38bde3f31639a7dee2923057812013178979174153e0df42a54bb5abb
SHA512

969d7c9833731d2d6150fe7ef45c741a565e367139042df8061e13ac7c426e1068bbadf4acc3b8a13361f3c19a260de9604ebd05701265669f543cd489851a0e
SSDEEP

3072:x4+b68SVKKgiLOa/wR6G5mCEU5+OmL47a4kW8BrwjiXTheS1F1IojG2RutI39pP:EjVrwZVEUYOm+DkWpiXTbfCT2YC3

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5764062937:AAHmiesTr6Z7n5aCQmZlon17u47KFOBnTT8/

Targets

- Target
  
  1808-57-0x00000000050B0000-0x00000000050E8000-memory.dmp
- Size
  
  224KB
- MD5
  
  57a8d21d0dcaba33dfef947466604345
- SHA1
  
  b29d32c144d7bb197c3038cdd74315115d34c25f
- SHA256
  
  0a91dce38bde3f31639a7dee2923057812013178979174153e0df42a54bb5abb
- SHA512
  
  969d7c9833731d2d6150fe7ef45c741a565e367139042df8061e13ac7c426e1068bbadf4acc3b8a13361f3c19a260de9604ebd05701265669f543cd489851a0e
- SSDEEP
  
  3072:x4+b68SVKKgiLOa/wR6G5mCEU5+OmL47a4kW8BrwjiXTheS1F1IojG2RutI39pP:EjVrwZVEUYOm+DkWpiXTbfCT2YC3
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2