agenttesla | c5b618054d855fffed65dc372080cdc5de39ca31edd513e7765a02c64f9b9e1b | Triage

Sharing

General

Target

Cotización-202002721.pdf.exe
Size

473KB
Sample

230328-vjdpaadg41
MD5

bf2d6295a7e04f44e50101fd3df6b34f
SHA1

223321e3e18c453875f4d625b1327b8a8e05de1a
SHA256

c5b618054d855fffed65dc372080cdc5de39ca31edd513e7765a02c64f9b9e1b
SHA512

fcec0b125961d7ae9f1672e85e61ff0c58a0aa58a3a0686816c32be0581352c08a7a46b16bbe9073f640d26e81b1cd7a0791aa5ea44380b2defb5342db2f79e6
SSDEEP

12288:943FAhu8y7mMaBXkiB/ZrLX/qFiyDwHi220AbWxQhi:e3FSunDuXBX62gvs

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.itzayanaland.com
Port:
587
Username:
security01@itzayanaland.com
Password:
H!S6_PFHTAN{
Email To:
security01@itzayanaland.com

Targets

- Target
  
  Cotización-202002721.pdf.exe
- Size
  
  473KB
- MD5
  
  bf2d6295a7e04f44e50101fd3df6b34f
- SHA1
  
  223321e3e18c453875f4d625b1327b8a8e05de1a
- SHA256
  
  c5b618054d855fffed65dc372080cdc5de39ca31edd513e7765a02c64f9b9e1b
- SHA512
  
  fcec0b125961d7ae9f1672e85e61ff0c58a0aa58a3a0686816c32be0581352c08a7a46b16bbe9073f640d26e81b1cd7a0791aa5ea44380b2defb5342db2f79e6
- SSDEEP
  
  12288:943FAhu8y7mMaBXkiB/ZrLX/qFiyDwHi220AbWxQhi:e3FSunDuXBX62gvs
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan