agenttesla

General

Target

3efc1b97fec22aac64312a98c7a5d2aece1d84dbacd6f7a082333fc25ccdf84d
Size

356KB
Sample

231206-dhbpvsae68
MD5

10d3a4644025e145422f88dadec5d0a0
SHA1

413e8e5cbb54d0886bd3d34b15ee28646a90b771
SHA256

3efc1b97fec22aac64312a98c7a5d2aece1d84dbacd6f7a082333fc25ccdf84d
SHA512

3560b64d43c066b5b0145caa72828dee4ce1e3c9fad028521db606da88739c77f721d252f5936e417f57ed0c104c37be68a6b6c2eda2eb4014d9da1545d0ad21
SSDEEP

6144:Ro6G1waDn8VZNzqKqZx5nsvbGc43sQV7WJtOZdk/9+qFeQtO9BJj02:RyvD2ZJqx5nybtMXW/Ca/9JVtO9BW2

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sturmsgroup.com
Port:
587
Username:
[email protected]
Password:
hs_B2R1px4ASsOhR
Email To:
[email protected]

Targets

- Target
  
  Yjcznyaio.exe
- Size
  
  485KB
- MD5
  
  19c87b62fa468077f1b27cee9fd24f38
- SHA1
  
  ce03e531253aefdcba09c4daf4054e0e787bc6ad
- SHA256
  
  9b7e62af80bd6db7c63b34d69435354e1650316baf0dbaa387a486651cbdaf4e
- SHA512
  
  b3cc33e888c10d46b42cbe774e9affe7d202c82ad6b9686565355802ffb19fe7dd98a12702c687f6d50dc5dab64f057a481d00e29c504577ffe06db716803494
- SSDEEP
  
  6144:mDBVFYIJ1UIZNzmKqZxLnsvbGc23sQ37WJPOZd+/9+qu1Hhsg26gzrelVJ:mDTXTZJmxLnybtaJW1Cw/9aLuX
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2