agenttesla

General

Target
f53be2a63c3bc58b077bd3a4816bbb3e1df72ed64ffce8720c2fc7c3485dec41.exe
Size 217KB
Sample230907-mlhr1sgf67
SHA256 f53be2a63c3bc58b077bd3a4816bbb3e1df72ed64ffce8720c2fc7c3485dec41
MD5 c06870659f98ea5dfdd8cf59c88708c6
SHA1 9a9586a28d4e2d2db3b31858dfdb296a66d27def
SHA512 f09e353a139fee4a980ab9553c224592a66d46e14e700981374d07b8f32529a6c298e08189b8ad804cefafad817e5dfe7f51001bd4220739186fbff1724d77b2
SSDEEP 6144:McqEvGwh0m1je9VNB1EUL4uYgHhMgZ3C15sFSHtZsBGnUyFw+kPaD:McqEuG0m1jcNB7L4uYgB/ZASFSHtZU+H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.maleksalame.com
Port
587
Username
[email protected]
Password
cynthiams@2211

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.maleksalame.com
Port
587
Username
[email protected]
Password
cynthiams@2211
Email to
[email protected]

Targets

- Target
  f53be2a63c3bc58b077bd3a4816bbb3e1df72ed64ffce8720c2fc7c3485dec41.exe
- Size 217KB
- SHA256 f53be2a63c3bc58b077bd3a4816bbb3e1df72ed64ffce8720c2fc7c3485dec41
- MD5 c06870659f98ea5dfdd8cf59c88708c6
- SHA1 9a9586a28d4e2d2db3b31858dfdb296a66d27def
- SHA512 f09e353a139fee4a980ab9553c224592a66d46e14e700981374d07b8f32529a6c298e08189b8ad804cefafad817e5dfe7f51001bd4220739186fbff1724d77b2
- SSDEEP 6144:McqEvGwh0m1je9VNB1EUL4uYgHhMgZ3C15sFSHtZsBGnUyFw+kPaD:McqEuG0m1jcNB7L4uYgB/ZASFSHtZU+H
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2