agenttesla

General

Target

SecuriteInfo.com.Win32.PWSX-gen.32559.23239.exe
Size

716KB
Sample

231201-njvjgahe21
MD5

da1d7932229b720f188bb1586de920db
SHA1

82028dd1c32fafee8ea4351a108b2d1f29cedd33
SHA256

5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d
SHA512

6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c
SSDEEP

12288:P9dILHw5do+xUI3LcZ/lHDAuNp9ZzNzuj+/k0SCbNOX8hoSOATdFsv:P9ycdo+b3LcRlHDAcpLzN5/k0SChOXi0

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.royalwealth.space
Port:
587
Username:
[email protected]
Password:
sQxM4AdAZ5kY7As
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.royalwealth.space
Port:
587
Username:
[email protected]
Password:
sQxM4AdAZ5kY7As

Targets

- Target
  
  SecuriteInfo.com.Win32.PWSX-gen.32559.23239.exe
- Size
  
  716KB
- MD5
  
  da1d7932229b720f188bb1586de920db
- SHA1
  
  82028dd1c32fafee8ea4351a108b2d1f29cedd33
- SHA256
  
  5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d
- SHA512
  
  6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c
- SSDEEP
  
  12288:P9dILHw5do+xUI3LcZ/lHDAuNp9ZzNzuj+/k0SCbNOX8hoSOATdFsv:P9ycdo+b3LcRlHDAcpLzN5/k0SChOXi0
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2