agenttesla

General

Target
DHL PK 160612561677.exe
Size 682KB
Sample230509-jqfxfaeg97
SHA256 bad91ee1b8c242bcc2f84bce17fe357e8121ea564cb62c4ff96e0bf52f1a06a2
MD5 66d669763cfe1bac5702cd094b927d80
SHA1 e8d91e7a9c26229ba036b7dc5f996554e9d7600b
SHA512 191288d819d16b45347e130f91c7d4d04a8212facf1f0117427074dadade9d1310eae1587a14bb806b48e4d2bacce73804788050a028b681d548928f9e4dc878
SSDEEP 12288:CPhQHbAPDl5i5dVIi07sl5Uw8Xtf77uoZUYt1LTzmbUzSLZ5n1:AhQcPDl5iJl0glWrl77uSjLXmozSLH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
DSJBtPsn2
Email to
[email protected]

Targets

- Target
  DHL PK 160612561677.exe
- Size 682KB
- SHA256 bad91ee1b8c242bcc2f84bce17fe357e8121ea564cb62c4ff96e0bf52f1a06a2
- MD5 66d669763cfe1bac5702cd094b927d80
- SHA1 e8d91e7a9c26229ba036b7dc5f996554e9d7600b
- SHA512 191288d819d16b45347e130f91c7d4d04a8212facf1f0117427074dadade9d1310eae1587a14bb806b48e4d2bacce73804788050a028b681d548928f9e4dc878
- SSDEEP 12288:CPhQHbAPDl5i5dVIi07sl5Uw8Xtf77uoZUYt1LTzmbUzSLZ5n1:AhQcPDl5iJl0glWrl77uSjLXmozSLH
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2