agenttesla

General

Target
DHL AWB - Invoice & Shipping Documents.exe
Size 883KB
Sample230428-fnkaasca23
SHA256 fde44c87c4f5bb65134e59545fbe40e5f6d6ffdfc397fe247c55f523eb8bea9a
MD5 d111a3fc2543b3ca7e953237f3c4f62f
SHA1 143ab676d50017a4d662f3f3f142510313862c35
SHA512 c74b49ef3a04bea308d3982eb290f2b656d9bfda35197be5f41095df78b27976d8832de0d906979296c4c049165cb7c6500b92acb9d232f54b35ef5565d6e3f7
SSDEEP 12288:E8/9WflU/9Zov9lp5ZMvPCTxE+71jPmvyYiEZOSUdF4cJp9znPshcRZfVSLUY:jylUDol35ZMq+shdF5JAhcRZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.nutiribio.com
Port
587
Username
[email protected]
Password
zGNVO(l5

Targets

- Target
  DHL AWB - Invoice & Shipping Documents.exe
- Size 883KB
- SHA256 fde44c87c4f5bb65134e59545fbe40e5f6d6ffdfc397fe247c55f523eb8bea9a
- MD5 d111a3fc2543b3ca7e953237f3c4f62f
- SHA1 143ab676d50017a4d662f3f3f142510313862c35
- SHA512 c74b49ef3a04bea308d3982eb290f2b656d9bfda35197be5f41095df78b27976d8832de0d906979296c4c049165cb7c6500b92acb9d232f54b35ef5565d6e3f7
- SSDEEP 12288:E8/9WflU/9Zov9lp5ZMvPCTxE+71jPmvyYiEZOSUdF4cJp9znPshcRZfVSLUY:jylUDol35ZMq+shdF5JAhcRZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2