agenttesla | 1a321cfb8647c14d3ff24d20572ea1165e3e07251751ac485d8d2fbb3ac111ef | Triage

Sharing

General

Target

1a321cfb8647c14d3ff24d20572ea1165e3e07251751ac485d8d2fbb3ac111ef
Size

997KB
Sample

231207-ca1hksgffm
MD5

e0bf5c50fdec6e23721798acf56c7e8f
SHA1

0976d0d91a0ad285a027f526cd6451a5db7943c1
SHA256

1a321cfb8647c14d3ff24d20572ea1165e3e07251751ac485d8d2fbb3ac111ef
SHA512

bee98559adab3c2932b65658fed0ebe11690198c7192c17281df127ce07cddff0542c04e393eb3546059f8ecc7c8fd19261bb2fcdf24c526938609e886f6cca6
SSDEEP

24576:7xizBcjENqXUFGEq3ezspBR0TJqwfFH4nLxwpdxAix29C:OBcuvPnCjQqwNHExw7G99C

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.siscop.com.co
Port:
21
Username:
[email protected]
Password:
+5s48Ia2&-(t

Targets

- Target
  
  1a321cfb8647c14d3ff24d20572ea1165e3e07251751ac485d8d2fbb3ac111ef
- Size
  
  997KB
- MD5
  
  e0bf5c50fdec6e23721798acf56c7e8f
- SHA1
  
  0976d0d91a0ad285a027f526cd6451a5db7943c1
- SHA256
  
  1a321cfb8647c14d3ff24d20572ea1165e3e07251751ac485d8d2fbb3ac111ef
- SHA512
  
  bee98559adab3c2932b65658fed0ebe11690198c7192c17281df127ce07cddff0542c04e393eb3546059f8ecc7c8fd19261bb2fcdf24c526938609e886f6cca6
- SSDEEP
  
  24576:7xizBcjENqXUFGEq3ezspBR0TJqwfFH4nLxwpdxAix29C:OBcuvPnCjQqwNHExw7G99C
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan