agenttesla | 60a107b83a792df4cafbe67547cf3663ee3e2277572f8778bb78bd226d9188d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PAYMENT SLIP.exe
Size

803KB
Sample

230523-vmyhvshb7t
MD5

df56781656a194f03072f7039f5a7ea1
SHA1

d48bf6de495b4a0d0525c28eba875473654765f4
SHA256

60a107b83a792df4cafbe67547cf3663ee3e2277572f8778bb78bd226d9188d8
SHA512

641ebae2405c46ccb41e8c2bbdbd89b1bd5206fe40e6cb57de2e44a1749cfd8f332b5697e6d9c18769c322e2d746de08e94e36be9c53f1a9ce3ec53791a100a5
SSDEEP

12288:Aq5iTB2QwUKIpcJMfcVpwGRYaaJwKuA3rChEJxnp:AqmX2+cVpWDJwKx3rvD

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sarahfoils.com
Port:
587
Username:
[email protected]
Password:
Scalatica01
Email To:
[email protected]

Targets

- Target
  
  PAYMENT SLIP.exe
- Size
  
  803KB
- MD5
  
  df56781656a194f03072f7039f5a7ea1
- SHA1
  
  d48bf6de495b4a0d0525c28eba875473654765f4
- SHA256
  
  60a107b83a792df4cafbe67547cf3663ee3e2277572f8778bb78bd226d9188d8
- SHA512
  
  641ebae2405c46ccb41e8c2bbdbd89b1bd5206fe40e6cb57de2e44a1749cfd8f332b5697e6d9c18769c322e2d746de08e94e36be9c53f1a9ce3ec53791a100a5
- SSDEEP
  
  12288:Aq5iTB2QwUKIpcJMfcVpwGRYaaJwKuA3rChEJxnp:AqmX2+cVpWDJwKx3rvD
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan