agenttesla | 4728aa46a6f72a48383ccfda1a28d201fcef35ddfd013c4be103c4033ea319b6 | Triage

Sharing

General

Target

S O A-#7A68D20.zip
Size

614KB
Sample

230414-hlzy3sgg35
MD5

72dd4b88841e181922a2c90de4318055
SHA1

484b2c798f97302af5ebcb7b8d557d1a88b37fe2
SHA256

4728aa46a6f72a48383ccfda1a28d201fcef35ddfd013c4be103c4033ea319b6
SHA512

6a63bf1faa2db075c708edbe09d1783aaeee6150c43a78152265f78c21cf8e39ae03cd6a1f5d71205f2c26475e0934959ea18774e2db2faa5cff90003281bfb3
SSDEEP

12288:sEeFdR/v/k9s4qFElSnoFH7zsOs7jcFkp7lDe9Mu35r4ISOSA5QmGPkQxa:E/dkqtdnOH7T+ykNlyMc5r4ISK7

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.expertsconsultgh.co
Port:
587
Username:
[email protected]
Password:
Oppong.2012
Email To:
[email protected]

Targets

- Target
  
  S O A-#7A68D20.exe
- Size
  
  897KB
- MD5
  
  1b695780b11013d265aef8c9956e504e
- SHA1
  
  89fce8644741d78486126a65281e53309f91beac
- SHA256
  
  b607b4f3391d0e8bce2d4801df87c28eb6341a201f3aecdfc4ed5f28c72856a9
- SHA512
  
  e4565b86bb4b2f3868555dcad43c507d949cb8a8a19121609cf9f29470672f9582e51aa650b80e8f448ede4608e53467a441968c2d519cfc94f42d918539152e
- SSDEEP
  
  12288:2S0pbuG4HtI84UFH5zsgs7l8FGp53Dedkuj53JOSuzqHu2rmaPEQ:wZcG84yH5T+wG73Ok053JM
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan