agenttesla | 7f4eaccd05489039f57a3d4258721fd636ce8ec8104c2184d366af9a75498e8e | Triage

Sharing

General

Target

02372599.exe
Size

787KB
Sample

230614-pde29sge93
MD5

7c34e879f19cda6ddce16d1468298e4a
SHA1

4d2793ce804d1b0784d607f46890425cc54688fa
SHA256

7f4eaccd05489039f57a3d4258721fd636ce8ec8104c2184d366af9a75498e8e
SHA512

df0f8d17daa27ba150584ff32dd122033aa3c0cbcfca2189ec1414c62610d47b0b8a2b56a3b104257603aad7cdc8cc159846adfe83f109132c8643713cbe7ce7
SSDEEP

12288:xQwTr3+sMJBGRKe7q6gHtSBV0+LygkDAAdfY:9mfGRfq7YBVByg5A

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.exceltruea.com
Port:
587
Username:
[email protected]
Password:
bl es si ng 2 0 2 3
Email To:
[email protected]

Targets

- Target
  
  02372599.exe
- Size
  
  787KB
- MD5
  
  7c34e879f19cda6ddce16d1468298e4a
- SHA1
  
  4d2793ce804d1b0784d607f46890425cc54688fa
- SHA256
  
  7f4eaccd05489039f57a3d4258721fd636ce8ec8104c2184d366af9a75498e8e
- SHA512
  
  df0f8d17daa27ba150584ff32dd122033aa3c0cbcfca2189ec1414c62610d47b0b8a2b56a3b104257603aad7cdc8cc159846adfe83f109132c8643713cbe7ce7
- SSDEEP
  
  12288:xQwTr3+sMJBGRKe7q6gHtSBV0+LygkDAAdfY:9mfGRfq7YBVByg5A
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan