agenttesla

General

Target
decode_d7e6aa1c282d0c7e264deac72702696a8295cd54fa9b12218af646cbffa03a1f.exe
Size 216KB
Sample230123-s5cm1aea38
SHA256 634d417309429ce5c6a447e15571db7435f58a750ca1d29d29b2abbbf03c4e54
MD5 7576ceaac2bb65f39a3cb71f429976da
SHA1 fa80ffd5aaf7992a58b403051d04bdab2800de70
SHA512 da4a1c7f38fcbf3dbc7f64439a856017695395e55fd28c959414438e15ba8a0757d6acd1c9dc2e40e19a93cd339381ef5f7a7925ff5975c8efc40d34a909d3f8
SSDEEP 3072:BfGWGrL0fWK9kmiY1WbxUsKUeyvfVessnUYMJRltSoKFb9dloNdVMI9UtUTQs:xt9kmbwUNy1eF2SpSvVMyIUT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument

Targets

- Target
  decode_d7e6aa1c282d0c7e264deac72702696a8295cd54fa9b12218af646cbffa03a1f.exe
- Size 216KB
- SHA256 634d417309429ce5c6a447e15571db7435f58a750ca1d29d29b2abbbf03c4e54
- MD5 7576ceaac2bb65f39a3cb71f429976da
- SHA1 fa80ffd5aaf7992a58b403051d04bdab2800de70
- SHA512 da4a1c7f38fcbf3dbc7f64439a856017695395e55fd28c959414438e15ba8a0757d6acd1c9dc2e40e19a93cd339381ef5f7a7925ff5975c8efc40d34a909d3f8
- SSDEEP 3072:BfGWGrL0fWK9kmiY1WbxUsKUeyvfVessnUYMJRltSoKFb9dloNdVMI9UtUTQs:xt9kmbwUNy1eF2SpSvVMyIUT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2