agenttesla | f7d13a8cd4adce86fcef91cd692ffa1b8b65933dc413d9346c1dae334ffdb984 | Triage

Sharing

General

Target

f7d13a8cd4adce86fcef91cd692ffa1b8b65933dc413d9346c1dae334ffdb984
Size

656KB
Sample

231204-lb8p1sac36
MD5

4b17c2d23fc2f7533045045cfb38763c
SHA1

c6952e6a13db54bf5cf7cfff7a9eb0b230592a9d
SHA256

f7d13a8cd4adce86fcef91cd692ffa1b8b65933dc413d9346c1dae334ffdb984
SHA512

307fd42f31a04ee392530fe9fe7dddf752b567b50bc64c8fa868f60f7748b39dff47bb0c5852ac57e40eeb960cc033fef20aba04efd323f6e070ce31fed40405
SSDEEP

12288:7DpqnPD075aRDvlStT9Wrl6wQjHyYH6pkCOqoBnCvfzNcXecyFOAv1X4d9:7DpwPYIzlStUlnQjHDHykCOFnCvLeXBL

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
NX@@OLDdollarDV8FW7
Email To:
[email protected]

Targets

- Target
  
  LAM CHUAN.exe
- Size
  
  739KB
- MD5
  
  c74873ebdfa9adb3a07c72fedd70ed5c
- SHA1
  
  67a322f8f715f8d5e347efeb5fa25efd98a7b229
- SHA256
  
  497bf18f3fcb0080d21c8f9a98a054bdbcfb7da1fe1c93a28bfdb8b84560b10a
- SHA512
  
  9cd7f335c8d217581d134f8aba3c1f806b2a6a080070137e50b7ffee567e485b3233a58853ebebd748fc263d69d9400597fea523cfbb7f7221cbd5e4cd9b2951
- SSDEEP
  
  12288:5WBCMtW8G34/uK45+po2aWRl2w63HyYNMpWAOgaNn6b+sZJzHh+gekeFqm6y:ii34/up+pJ3lj63HDNEWAOgen6isZ1He
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan