agenttesla

General

Target
REMITTANCE COPY 0020200244442023.gz.exe
Size 744KB
Sample231101-l6smaagh44
SHA256 f31bb7435b6f8828e77f9abcf151a84db7d2bf965443682f79e0e223be7c86ca
MD5 62307ee86b3aa47e9f7b845fb5d56902
SHA1 a36eed15e18e8a1566ac48de03e24c0642b34cc4
SHA512 d6deccf69337f94549dfdb485fff84c3273715240fca8c05b3aa837f9aaa9f995f8aa0602e20d88ca6fd01c3732e638c72b460205a745a033495a0b9f857502f
SSDEEP 12288:eMuce8G9LFaUrKRHG9XjHkmgxxN57L20Y/tRmpBrfRfYKXN8GGyxrVDOrg4d/4WB:e58G95UHG9XjGhhY/tRebXd53Os4uW9N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.obynnehhhan.com
Port
587
Username
[email protected]
Password
G$MUuYG3

Targets

- Target
  REMITTANCE COPY 0020200244442023.gz.exe
- Size 744KB
- SHA256 f31bb7435b6f8828e77f9abcf151a84db7d2bf965443682f79e0e223be7c86ca
- MD5 62307ee86b3aa47e9f7b845fb5d56902
- SHA1 a36eed15e18e8a1566ac48de03e24c0642b34cc4
- SHA512 d6deccf69337f94549dfdb485fff84c3273715240fca8c05b3aa837f9aaa9f995f8aa0602e20d88ca6fd01c3732e638c72b460205a745a033495a0b9f857502f
- SSDEEP 12288:eMuce8G9LFaUrKRHG9XjHkmgxxN57L20Y/tRmpBrfRfYKXN8GGyxrVDOrg4d/4WB:e58G95UHG9XjGhhY/tRebXd53Os4uW9N
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2