agenttesla

General

Target

6149b0dde92a3da518db88f71c5b105a7cc2d66ea33d12cb058056fcaa864cae
Size

908KB
Sample

231205-vm9acsdd67
MD5

bb2658ad62d5fc81c0e970c54bcc6d03
SHA1

3d630cf3ac0a351f05fbd19a848bd58940af1109
SHA256

6149b0dde92a3da518db88f71c5b105a7cc2d66ea33d12cb058056fcaa864cae
SHA512

f255b2045006511e9574b52beafb946993a94689583c62538f1fee41b7de819136f07293082a3e48a60b6e1be11397770c7b8245ab8476bcfb80c27b69962f6b
SSDEEP

24576:V34/up+pJLvN6UNLma2sPxCZTKlo1P1QA:V38PJLvYMLmjs0FKlojQA

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.wxaumn.com
Port:
587
Username:
[email protected]
Password:
[Eq(B(Pcx?yA
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.wxaumn.com
Port:
587
Username:
[email protected]
Password:
[Eq(B(Pcx?yA

Targets

- Target
  
  6149b0dde92a3da518db88f71c5b105a7cc2d66ea33d12cb058056fcaa864cae
- Size
  
  908KB
- MD5
  
  bb2658ad62d5fc81c0e970c54bcc6d03
- SHA1
  
  3d630cf3ac0a351f05fbd19a848bd58940af1109
- SHA256
  
  6149b0dde92a3da518db88f71c5b105a7cc2d66ea33d12cb058056fcaa864cae
- SHA512
  
  f255b2045006511e9574b52beafb946993a94689583c62538f1fee41b7de819136f07293082a3e48a60b6e1be11397770c7b8245ab8476bcfb80c27b69962f6b
- SSDEEP
  
  24576:V34/up+pJLvN6UNLma2sPxCZTKlo1P1QA:V38PJLvYMLmjs0FKlojQA
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2