agenttesla | ab3b593028ef395dd1a37d3d0e10d41c1e8d826c100228dd8c473f83044ec3b6 | Triage

Sharing

General

Target

AB3B593028EF395DD1A37D3D0E10D41C1E8D826C100228DD8C473F83044EC3B6
Size

475KB
Sample

221208-yfbbjabb87
MD5

385bf0643cec07b14980ab49d81e2b36
SHA1

09664ec753d6ac0fb4164562f599f14fd3f3e416
SHA256

ab3b593028ef395dd1a37d3d0e10d41c1e8d826c100228dd8c473f83044ec3b6
SHA512

3a251a6207a54b91a448906b9e4c40d076e10426ac6b76508ba31652c952820ea6b0e97446029ace4bc8d5ad32520f59f1df03d1d47c6a27a0070b7fcc71e09e
SSDEEP

12288:ndNxWkDSFV68KbkY4DrIaKJL3l90HsmtJQ+:14VokNDrID1fG9O+

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.elec-qatar.com
Port:
587
Username:
[email protected]
Password:
MHabrar2019@#
Email To:
[email protected]

Targets

- Target
  
  SHIPPING DOC.exe
- Size
  
  478KB
- MD5
  
  d1c1aac83a4eb44e1f5a150b1f9ea01a
- SHA1
  
  54972afe738a2255c2f319b3077a6413a812809b
- SHA256
  
  50c5c887aece86fb6b2dd1184c183c87082ae8a126d52a7e735449f6be8fb68c
- SHA512
  
  19cb24c312e122fb876246b96d76f114c9115441faf139f9b465000948349b8c547c56e973a2aa9c154e0308700adcf51c593543d58a48e28bba5a111eebae38
- SSDEEP
  
  6144:0iE2fjXwDnSBb/66RUEdKborY4A3O92KBXRr+tdP1ueDkkaDSL3J3iwjIzL2Ga+c:0asDSpJ6yKb0Y4ZvOQoVL3FjM9sEV
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan