agenttesla

General

Target

E07D79C46FB481AA3E8F118E3F0B059A993B655DF815BDFD4708495A45C2568B
Size

1.2MB
Sample

231206-eplzvaba68
MD5

3ebc619b1635a392dfd4b845f7e9b4ca
SHA1

6eea96fabc5d075d5851475f36d186593f8e8877
SHA256

e07d79c46fb481aa3e8f118e3f0b059a993b655df815bdfd4708495a45c2568b
SHA512

24874d59e83b8d75bb1c3514c704eccd4531add888e3ea37e83b556fa2726db1af9ad726d8960b677a9859a44932c9e5bb05005a1838949b878fa80f3b5e9ae1
SSDEEP

12288:Pelc5Fqrvh3ukGR8FFkbuqqKRY+ROuUFkCiUJ+nkweoWy3Hr4l/rQyw8GzNKJ4ea:kqs+RtUFPJc7eoWy3L4llXG+4e67M8v

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mbarieservicesltd.com
Port:
587
Username:
[email protected]
Password:
*o9H+18Q4%;M
Email To:
[email protected]

Targets

- Target
  
  PO771000.EXE
- Size
  
  668KB
- MD5
  
  761b671d5b64b55a08df55fc1f719801
- SHA1
  
  72beee839b56b8473efa2e98d751f56251f4c571
- SHA256
  
  f59249e0421edc3799b01d06dfdfd1877edb5bdf70d777e9aafbcf5570f641c5
- SHA512
  
  e97978f1d6c4a22f660b2351cb5df2b0aac89c85f513a87d1bd6d5a7c802b27cc378d70147a1d221b9755a2ce985f04bd75287634a344dc1a514e0ae6e22b208
- SSDEEP
  
  12288:nelc5Fqrvh3ukGR8FFkbuqqKRY+ROuUFkCiUJ+nkweoWy3Hr4l/rQyw8GzNKJ4ea:8qs+RtUFPJc7eoWy3L4llXG+4e67M8v
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2