agenttesla

General

Target

ca2d2e7dcf94131fbdaca7a1369c3943578772fdddb5e2f45153d20a5a13e33c
Size

820KB
Sample

231205-vb8jpace8t
MD5

9d98290f0109c381dbce1880e7487543
SHA1

178e23da55dca39852c8c3380231233941b98b35
SHA256

ca2d2e7dcf94131fbdaca7a1369c3943578772fdddb5e2f45153d20a5a13e33c
SHA512

799d3aac55310311b2c25e7ba6dbbf6754ab35b0dfe65fc7728367503db892dbab312359c9b590748e00db5640b278e66201d3ae693734d2a1242dc2e4da57af
SSDEEP

12288:RW0otW8G34/uK45+po29gLTLWWCcgd1sed2k0Yo9ZF+TS4nKiMtNTszBfPey:934/up+pJqLTLqXd1seB0V3iOTsFe

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  ca2d2e7dcf94131fbdaca7a1369c3943578772fdddb5e2f45153d20a5a13e33c
- Size
  
  820KB
- MD5
  
  9d98290f0109c381dbce1880e7487543
- SHA1
  
  178e23da55dca39852c8c3380231233941b98b35
- SHA256
  
  ca2d2e7dcf94131fbdaca7a1369c3943578772fdddb5e2f45153d20a5a13e33c
- SHA512
  
  799d3aac55310311b2c25e7ba6dbbf6754ab35b0dfe65fc7728367503db892dbab312359c9b590748e00db5640b278e66201d3ae693734d2a1242dc2e4da57af
- SSDEEP
  
  12288:RW0otW8G34/uK45+po29gLTLWWCcgd1sed2k0Yo9ZF+TS4nKiMtNTszBfPey:934/up+pJqLTLqXd1seB0V3iOTsFe
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2