agenttesla | 2a498ec26aa073c1aa73e988bc8bd75d6909738530f591c7811118b7c265c139 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

QUOTATION_AUG7FIBA00541·PDF.scr
Size

339KB
Sample

230823-kdsk5scc7t
MD5

28d3860cd6a05925823eee7745dbf545
SHA1

a10fa66e1eaba4ae413bd9a9a465fa9471d17e48
SHA256

2a498ec26aa073c1aa73e988bc8bd75d6909738530f591c7811118b7c265c139
SHA512

6b273b20e110214a8d2a3acb91b2e1634478e27de6366b1f7eaadfde66c2a439df4edde04d36130a728e5f7f2f8129b03707c936c13cc6edc69f2a97302283e9
SSDEEP

768:ClHsQ720zEjss2Hcg1Ijcn0sspAlpq8WLyg1uMN0+dzsR8+eE4bG6jW:0sQLUWpqZLy0uyL+f4bG6a

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
nxhvhvlhjbskrvmk
Email To:
[email protected]

Targets

- Target
  
  QUOTATION_AUG7FIBA00541·PDF.scr
- Size
  
  339KB
- MD5
  
  28d3860cd6a05925823eee7745dbf545
- SHA1
  
  a10fa66e1eaba4ae413bd9a9a465fa9471d17e48
- SHA256
  
  2a498ec26aa073c1aa73e988bc8bd75d6909738530f591c7811118b7c265c139
- SHA512
  
  6b273b20e110214a8d2a3acb91b2e1634478e27de6366b1f7eaadfde66c2a439df4edde04d36130a728e5f7f2f8129b03707c936c13cc6edc69f2a97302283e9
- SSDEEP
  
  768:ClHsQ720zEjss2Hcg1Ijcn0sspAlpq8WLyg1uMN0+dzsR8+eE4bG6jW:0sQLUWpqZLy0uyL+f4bG6a
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslakeyloggerspywarestealertrojan