agenttesla | a8862124bbd0b70abd9550142456342943e09f6dd447f09e2306c3e92b0685f3 | Triage

Sharing

General

Target

levél (02).docx.exe
Size

982KB
Sample

231011-mr16jsbd23
MD5

c43afea3c5d5ea18e5028efde2a7ffff
SHA1

69d1f8a162b73107b8ebfaa3e8d285ac0dc8ec52
SHA256

a8862124bbd0b70abd9550142456342943e09f6dd447f09e2306c3e92b0685f3
SHA512

814eef85c46df36a6f725ac1c67335934b20b36bf3b55acce43cc36dbe7f8130e1db5e6dfa5807699ddcfb8fab1e097ea0921fbb7f3de7a05e778554beeaa713
SSDEEP

12288:2wFgfrMBFuHkINL8OtPdW/3Nq88oskTJwtcTBTlEV+:2wFgDyuHZ98Ot0/dqwFplEV+

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.svetigeorgije.co.rs
Port:
21
Username:
[email protected]
Password:
4c5H&b2whkD9

Targets

- Target
  
  levél (02).docx.exe
- Size
  
  982KB
- MD5
  
  c43afea3c5d5ea18e5028efde2a7ffff
- SHA1
  
  69d1f8a162b73107b8ebfaa3e8d285ac0dc8ec52
- SHA256
  
  a8862124bbd0b70abd9550142456342943e09f6dd447f09e2306c3e92b0685f3
- SHA512
  
  814eef85c46df36a6f725ac1c67335934b20b36bf3b55acce43cc36dbe7f8130e1db5e6dfa5807699ddcfb8fab1e097ea0921fbb7f3de7a05e778554beeaa713
- SSDEEP
  
  12288:2wFgfrMBFuHkINL8OtPdW/3Nq88oskTJwtcTBTlEV+:2wFgDyuHZ98Ot0/dqwFplEV+
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan