agenttesla | 5be19a526bc4d972b4ce0ea323a03f8f364b22363c25c7f6250ffaf7904b90c6 | Triage

Sharing

General

Target

Ltd-2PKGS 702KGS 1.44CBM-2023-01-17-160-53565805 DEL.exe
Size

1.0MB
Sample

230403-qakn1sge41
MD5

925c0f515da9a950aae271a82493441b
SHA1

6e353faae64a5d487497105d476de60c33b310d1
SHA256

5be19a526bc4d972b4ce0ea323a03f8f364b22363c25c7f6250ffaf7904b90c6
SHA512

a152cf8b2fc75b4cfae5cc0206d348f2420179d976b1a12cfff00ca1dfc700dc40985f923c145da8917e99b379aee4166bcb14c398cfbc9f22b8bbdf089da10c
SSDEEP

12288:1tPVSOmCLjZ8yywVjfiqM9gd5fGTntwLi76+JGV8jZVnDTDkym3qJGF+Jl1KlYNJ:LUOmC/gwVbxM9s2tyFVo

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.expertsconsultgh.co
Port:
587
Username:
[email protected]
Password:
Oppong.2012
Email To:
[email protected]

Targets

- Target
  
  Ltd-2PKGS 702KGS 1.44CBM-2023-01-17-160-53565805 DEL.exe
- Size
  
  1.0MB
- MD5
  
  925c0f515da9a950aae271a82493441b
- SHA1
  
  6e353faae64a5d487497105d476de60c33b310d1
- SHA256
  
  5be19a526bc4d972b4ce0ea323a03f8f364b22363c25c7f6250ffaf7904b90c6
- SHA512
  
  a152cf8b2fc75b4cfae5cc0206d348f2420179d976b1a12cfff00ca1dfc700dc40985f923c145da8917e99b379aee4166bcb14c398cfbc9f22b8bbdf089da10c
- SSDEEP
  
  12288:1tPVSOmCLjZ8yywVjfiqM9gd5fGTntwLi76+JGV8jZVnDTDkym3qJGF+Jl1KlYNJ:LUOmC/gwVbxM9s2tyFVo
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan