agenttesla

General

Target

TEKLİF TALEP VE FİYAT TEKLİFİ_PDF.exe
Size

1016KB
Sample

231128-jzg6vsgd9v
MD5

28359695dcd722cd8ad82c6399825aa5
SHA1

db7620a226726208f465b39c8d73129c163e4a4e
SHA256

701182a3bb091638880b26c0d72edb8112862b127ed91f7d948918aeb427a471
SHA512

0387811d179f6e080cd779906a95ce9eeddcb2e9637621f7ad33e2f11a26c202d9ab1978417976f2c0a643fc54b7de233f3e2940e73249a7fc15e8c1a89188a6
SSDEEP

24576:8cOgfYxh9Je8INg9HY6rkPB3hoHEJZB/O6:jJf4Je69HYZhoHEJzB

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  TEKLİF TALEP VE FİYAT TEKLİFİ_PDF.exe
- Size
  
  1016KB
- MD5
  
  28359695dcd722cd8ad82c6399825aa5
- SHA1
  
  db7620a226726208f465b39c8d73129c163e4a4e
- SHA256
  
  701182a3bb091638880b26c0d72edb8112862b127ed91f7d948918aeb427a471
- SHA512
  
  0387811d179f6e080cd779906a95ce9eeddcb2e9637621f7ad33e2f11a26c202d9ab1978417976f2c0a643fc54b7de233f3e2940e73249a7fc15e8c1a89188a6
- SSDEEP
  
  24576:8cOgfYxh9Je8INg9HY6rkPB3hoHEJZB/O6:jJf4Je69HYZhoHEJzB
Score

10^/10

agenttesla guloader collection downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader,Cloudeye

Accesses Microsoft Outlook profiles

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2