agenttesla

General

Target
235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa.exe
Size 750KB
Sample230706-nbzs8abe7x
SHA256 235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa
MD5 8541058f618f74daf31cc2757e04af25
SHA1 ab2efc7c00b5b44c9db8e34e33f39201fa1a4930
SHA512 416843034dd78ce94a77801a50efc34c74fa417629ff898e332fab5919f1c918e83f7fd569b69c19010a41006b3934607c90c9cc44c6c421ee40e6aca9a03f97
SSDEEP 12288:Nd6L7PVx9fyiQbhaDnLMzIL2q+RTdOL8BqRs7AVgkusqmp0ErQh8+i365OmX9u/D:eOOyqGUL8Bq9VEsqgB65j9GyTOxM4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.nutiribio.com
Port
587
Username
[email protected]
Password
zGNVO(l5
Email to
[email protected]

Targets

- Target
  235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa.exe
- Size 750KB
- SHA256 235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa
- MD5 8541058f618f74daf31cc2757e04af25
- SHA1 ab2efc7c00b5b44c9db8e34e33f39201fa1a4930
- SHA512 416843034dd78ce94a77801a50efc34c74fa417629ff898e332fab5919f1c918e83f7fd569b69c19010a41006b3934607c90c9cc44c6c421ee40e6aca9a03f97
- SSDEEP 12288:Nd6L7PVx9fyiQbhaDnLMzIL2q+RTdOL8BqRs7AVgkusqmp0ErQh8+i365OmX9u/D:eOOyqGUL8Bq9VEsqgB65j9GyTOxM4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2