agenttesla | ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f | Triage

Sharing

General

Target

9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.arj
Size

551KB
Sample

231206-rgacasfb48
MD5

345009ea29b86f597742de30db3b9801
SHA1

d6b67f3bc29068d004793fdc067cb29b502b07d0
SHA256

ec2684a319f6bfe8314573d56adbce4ca4295415025325e212a2b033580d2a9f
SHA512

987216451a678406412c188c46f81a2a69efd813b0b83041a91a9de2daf917347c99d6d7c8078b7f8085ef60afd72d0b3f42c0f1040ed636aac6e2a60856d49a
SSDEEP

12288:vOUcl6zKtzH8rZuifqj2Lx4RF/riM1Ch+dtPs6rfOkFlJ:6PL8ZT7MF/rzA+dhs6TOKlJ

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
JUGCRsm9
Email To:
[email protected]

Targets

- Target
  
  9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.exe
- Size
  
  621KB
- MD5
  
  b4ca199a24f89305f407c5a4cc5c0323
- SHA1
  
  37f01604cd3128de1a1525d33b538d21ebce3fbf
- SHA256
  
  c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da
- SHA512
  
  ad3445d71495eb6b713ca40a42f0951eeb17fbeba15d963022f6a7d7aecd9f74aaddd576b554107818e8eeb3c3a0580ba6f40bc79c1773c2079f8dda5ed0c2af
- SSDEEP
  
  12288:OueH5qkEjDtnG3Tu1Zg4BfiVTQmf/NCUiMiCt7xY0aGqLCQ:Cq73o3Tu1Zg40T9/NviCt7hHCC
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan