agenttesla | a9cf955162a9164b63c70530a2ed72b02ab53f7b39a3a9ece842cd2bebfb117c | Triage

Sharing

General

Target

3.exe
Size

476KB
Sample

221209-nllpcada68
MD5

8eabbd8a98fa5f832cc89aa37fb596ce
SHA1

4428ff2dca82a79453ac64af960d94905f008594
SHA256

a9cf955162a9164b63c70530a2ed72b02ab53f7b39a3a9ece842cd2bebfb117c
SHA512

d42b9576d148ecd46998702031d7d309915ecac30f36028f6f5ec62883a20a8a8cb68a1624db40e9510b609ab9370684b2dc466c61a81cf6d1a7a6c1bd058489
SSDEEP

6144:4M0Nm8zFe6ytzIP0OAqUmYxO+C8r00F6mBf2UiHwtYv5uqa6XUpZPmr94aSfEXF5:4fNyhO+U6uPGYhCE1FRlYhLWPHQMlD

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.elec-qatar.com
Port:
587
Username:
[email protected]
Password:
MHabrar2019@#
Email To:
[email protected]

Targets

- Target
  
  3.exe
- Size
  
  476KB
- MD5
  
  8eabbd8a98fa5f832cc89aa37fb596ce
- SHA1
  
  4428ff2dca82a79453ac64af960d94905f008594
- SHA256
  
  a9cf955162a9164b63c70530a2ed72b02ab53f7b39a3a9ece842cd2bebfb117c
- SHA512
  
  d42b9576d148ecd46998702031d7d309915ecac30f36028f6f5ec62883a20a8a8cb68a1624db40e9510b609ab9370684b2dc466c61a81cf6d1a7a6c1bd058489
- SSDEEP
  
  6144:4M0Nm8zFe6ytzIP0OAqUmYxO+C8r00F6mBf2UiHwtYv5uqa6XUpZPmr94aSfEXF5:4fNyhO+U6uPGYhCE1FRlYhLWPHQMlD
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan