agenttesla | 770de70064348d681d3566ced39f477c786c50d2c267a4a045544b7339940a64 | Triage

Sharing

General

Target

770de70064348d681d3566ced39f477c786c50d2c267a4a045544b7339940a64
Size

826KB
Sample

221208-jqyggscc7y
MD5

7bf8cf4f9e2a7daf267a8a098f586b8e
SHA1

6cb9b445d6ac732a5a822591c03220820b47345a
SHA256

770de70064348d681d3566ced39f477c786c50d2c267a4a045544b7339940a64
SHA512

91330b06a4bff8ef0ade473346d6c4341d4b7d420e68c0d6cbe3f5eb073d24180c2a538d32abeede386d48074163c5946676311ab6230566ae8c90acd39bfd2b
SSDEEP

12288:dC/K7WY3cT2iIjNftGQdNpVo4PmQH/oVYHf5ahQWSH3FeqF:0K7W+49IjltGt4nH/oVksQNHVjF

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bretoffice.com
Port:
587
Username:
brets@bretoffice.com
Password:
Q4Nyam%+dQ^=
Email To:
bret@bretoffice.com

Targets

- Target
  
  770de70064348d681d3566ced39f477c786c50d2c267a4a045544b7339940a64
- Size
  
  826KB
- MD5
  
  7bf8cf4f9e2a7daf267a8a098f586b8e
- SHA1
  
  6cb9b445d6ac732a5a822591c03220820b47345a
- SHA256
  
  770de70064348d681d3566ced39f477c786c50d2c267a4a045544b7339940a64
- SHA512
  
  91330b06a4bff8ef0ade473346d6c4341d4b7d420e68c0d6cbe3f5eb073d24180c2a538d32abeede386d48074163c5946676311ab6230566ae8c90acd39bfd2b
- SSDEEP
  
  12288:dC/K7WY3cT2iIjNftGQdNpVo4PmQH/oVYHf5ahQWSH3FeqF:0K7W+49IjltGt4nH/oVksQNHVjF
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan