agenttesla | f12b00c60edb1f9db910d2011969a5231e969865fc981884454da649008f0db9 | Triage

Sharing

General

Target

f12b00c60edb1f9db910d2011969a5231e969865fc981884454da649008f0db9
Size

621KB
Sample

231201-l3c3esgh45
MD5

2b36d313620176c1201059a969293c8e
SHA1

6ea3a122a47472aa5e46ae3d11531aaefc7764a1
SHA256

f12b00c60edb1f9db910d2011969a5231e969865fc981884454da649008f0db9
SHA512

c114d784a3943ecf6c65bb348b87fe8c8ea1443f6ef906f8749e7fc02881fffed1b9959c99d8026cddfd8e618911cef0e7bd0161d8adc1efa62e8eb67165efa4
SSDEEP

12288:1A/k27LVv0ztqIEgYT9+Kyp6M9lBZ8HuhJ5Znl5s1+SWdg53pUagkdnMC:1A/R7LVssVTw/pd7ZWub5Z/s15WoU7A

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Lover boy @123
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Lover boy @123

Targets

- Target
  
  Shipping commercial invoice order confirmation #2303005328.pdf.exe
- Size
  
  717KB
- MD5
  
  98a8b2d442934424bdb49020bc3a6b50
- SHA1
  
  707004b4e79bb255c6128e54db6867713f8c5944
- SHA256
  
  237694adba91b73248b5c823bfbcc1c2169ccd44871be880926a6bdb6d665540
- SHA512
  
  c9768b7a9494ad0d4dc90f3443210d122da74b78824ad41b0707991ac6c849616fe3fe3ae84a3885ed02462ffceb450f4452dbbc331d235cd6e14f65f1fee78d
- SSDEEP
  
  12288:s+dIr3FcoVbJMVGioYAo9AfTLSmvSlVwVE6D8uZD:tu3XM+UULvcRud
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan