agenttesla | bc1cf6ade2e07cc46dd254933985c39647afef5408b8e55ef054f438683a5843 | Triage

Sharing

General

Target

Shipment_notification1666547433.exe
Size

933KB
Sample

221207-rhvpmafb45
MD5

5f76f0b41ac9b298d26f44826b1e4a0d
SHA1

2d9d42ea7ca927b8c14f8c4165f4ee6b7dab96b3
SHA256

bc1cf6ade2e07cc46dd254933985c39647afef5408b8e55ef054f438683a5843
SHA512

20024f43345b09d60f47befa9e6a60249b93bf5ad2cbd398b7ce5bbe7f74dc7691ff19a628271aa70d9084c65f138e08aaffe473322c843bc1f9094365eea57c
SSDEEP

24576:HJlSAKI2uGpsH62Va2ABKs29wDxwg5+RY:HXSpXbB7f7e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pumaelektrik.com
Port:
587
Username:
cs@pumaelektrik.com
Password:
cspen@#$123
Email To:
officeforward2@gmail.com

Targets

- Target
  
  Shipment_notification1666547433.exe
- Size
  
  933KB
- MD5
  
  5f76f0b41ac9b298d26f44826b1e4a0d
- SHA1
  
  2d9d42ea7ca927b8c14f8c4165f4ee6b7dab96b3
- SHA256
  
  bc1cf6ade2e07cc46dd254933985c39647afef5408b8e55ef054f438683a5843
- SHA512
  
  20024f43345b09d60f47befa9e6a60249b93bf5ad2cbd398b7ce5bbe7f74dc7691ff19a628271aa70d9084c65f138e08aaffe473322c843bc1f9094365eea57c
- SSDEEP
  
  24576:HJlSAKI2uGpsH62Va2ABKs29wDxwg5+RY:HXSpXbB7f7e
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan