agenttesla

General

Target

3c3fd62f50bb8de734f6c845e29e41c957ebccd878bd4b2ddd918845c4b0379e
Size

619KB
Sample

231201-jtzhysgb3v
MD5

8a73739bb817366678154266cd9b5645
SHA1

f875b318a02f5a6c4105be183c269ee546a15acf
SHA256

3c3fd62f50bb8de734f6c845e29e41c957ebccd878bd4b2ddd918845c4b0379e
SHA512

92dbf536134e5132810d01561f39994661b751738db32d26aa4070f18778161df111cd3ab467f922d508f16dac7a49f23f051ee3b90ec1788b91c42f03744d70
SSDEEP

12288:j5DCaqNzcLyb8aMc0BOww7nnhF3/Xdv2LRHCzO6VUFAb/qKPq9JQr3Z9Q13dN3:jp8z2yb8aDL7nhF3vdvIh6VUFA7qoqE0

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hltllc.com
Port:
587
Username:
[email protected]
Password:
Hlt@36@Gr#8
Email To:
[email protected]

Targets

- Target
  
  SKM-7088.exe
- Size
  
  715KB
- MD5
  
  5b7ea5a8e579fa9de99ab8812a8cf5c3
- SHA1
  
  2b321d8502b001fa3b04a38f9d1faf9146a1389f
- SHA256
  
  391d6c12f39cc9f83c7ec77261409e9168c9c21d8bf90288c5c9d5541ba2cf18
- SHA512
  
  e1e4b706b121e78d4236d32fa6c85e48fd33edc7f4b8066b50cae2ed335a73b51bb4e936f0284f5264f51d7ab1ce0da9c62e91f29d9ec56fc1ca51f1ad852032
- SSDEEP
  
  12288:ywdIjyqz4/kr1Nx6SL88KB0EyG9+f+O9/HP6Tvw3:F7/kRzo8KB0vg+z9/HCw3
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2