agenttesla | eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f | Triage

Sharing

General

Target

ENQUIRYPR-009583POWER ENERGY.pdf.exe
Size

604KB
Sample

230918-razcvahg2t
MD5

3e01756a6f2ffed6c3ee881233f371ca
SHA1

04466fd9c0c40a93c30c3c09a7bfacc5da3d5c51
SHA256

eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
SHA512

37afd734c0620c5cc807ea0e46e87d1746dcebdd7cf1e995c50efb1e5b8e0055579430b5b7b3190fd9ac0f1124b62f8fdb8d02618a9a2625804f57d829059b1f
SSDEEP

12288:CYnAfDuHOXHWk+qTK8jpPD1CtX2ZifPC2J0Ayf2fCJ:CYng5BxCwifPXJNe2a

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
JUGCRsm9
Email To:
[email protected]

Targets

- Target
  
  ENQUIRYPR-009583POWER ENERGY.pdf.exe
- Size
  
  604KB
- MD5
  
  3e01756a6f2ffed6c3ee881233f371ca
- SHA1
  
  04466fd9c0c40a93c30c3c09a7bfacc5da3d5c51
- SHA256
  
  eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
- SHA512
  
  37afd734c0620c5cc807ea0e46e87d1746dcebdd7cf1e995c50efb1e5b8e0055579430b5b7b3190fd9ac0f1124b62f8fdb8d02618a9a2625804f57d829059b1f
- SSDEEP
  
  12288:CYnAfDuHOXHWk+qTK8jpPD1CtX2ZifPC2J0Ayf2fCJ:CYng5BxCwifPXJNe2a
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan