agenttesla

General

Target

d53dbe75a5f24c92bf54fa24fb1f354cadf3369134d6adc6670d669bdb65a519.zip
Size

81KB
Sample

230308-qc7xbsbb3s
MD5

a4ed5d79196cbea3e6a063d1027f9466
SHA1

4ede64bf9fbc5cf44b23db2587a50bcb3abf855b
SHA256

a28058b5d7484eb247b986106458f8a3b1248342912e0a46ccd473323ffc3983
SHA512

f0f6048813447511339a90dbddcb9ee011bf393c8f14e62d7c0e0a2c3948823216efa98d104e5a0d3299cde1251a9951442122e6848b7bf31453fe9c1dc56c6a
SSDEEP

1536:kJfhNFp4LW3PS+lHph4wmH/4WltEzGo7m3GAXXj54J4NLFp5TQOF+8Bi:Q7Fp4ePNJnz7Uvj54GTxrE

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.1and1.es
Port:
587
Username:
[email protected]
Password:
vanesalucia00
Email To:
[email protected]

Targets

- Target
  
  d53dbe75a5f24c92bf54fa24fb1f354cadf3369134d6adc6670d669bdb65a519.exe
- Size
  
  164KB
- MD5
  
  4b4efbbb0e061f3e65ae99d798bf79b0
- SHA1
  
  7d8f2970b7843b21316c54c80c1fc3fd3ff44912
- SHA256
  
  d53dbe75a5f24c92bf54fa24fb1f354cadf3369134d6adc6670d669bdb65a519
- SHA512
  
  ffd245c4d0fe3cae70204a08ec347da21c827ee8b50ff97132da77a79dce31edf81d70337f8a3d2980757129896777872b11912b8df0ee981a68b3ca8d1572da
- SSDEEP
  
  3072:bBxW8XpZYzOuE1e7WelumAbMx+ZYcEHimZpKRX/etf2tLPl:lL0ye7W+ZxMEHimCZ/a2VP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2